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Abstract 

A PCP is a proof system for NP in which the proof can be checked by a probabihstic 
verifier. The verifier is only allowed to read a very small portion of the proof, and in return 
is allowed to err with some bounded probability. The probability that the verifier accepts a 
false proof is called the soundness error, and is an important parameter of a PCP system that 
one seeks to minimize. Constructing PCPs with sub-constant soundness error and, at the same 
time, a minimal number of queries into the proof (namely two) is especially important due to 
applications for inapproximability. 

In this work we construct such PCP verifiers, i.e., PCPs that make only two queries and have 
sub-constant soundness error. Our construction can be viewed as a combinatorial alternative 
to the "manifold vs. point" construction, which is the only construction in the literature for 
this parameter range. The "manifold vs. point" PCP is based on a low degree test, while 
our construction is based on a direct product test. We also extend our construction to yield a 
decodable PCP (dPCP) with the same parameters. By plugging in this dPCP into the scheme of 
Dinur and Harsha (FOCS 2009) one gets an alternative construction of the result of Moshkovitz 
and Raz (FOCS 2008), namely: a construction of two-query PCPs with small soundness error 
and small alphabet size. 

Our construction of a PCP is based on extending the derandomized direct product test 
of Impagliazzo, Kabanets and Wigderson (STOC 09) to a derandomized parallel repetition 
theorem. More accurately, our PCP construction is obtained in two steps. We first prove a 
derandomized parallel repetition theorem for specially structured PCPs. Then, we show that 
any PCP can be transformed into one that has the required structure, by embedding it on a 
de-Bruijn graph. 
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1 Introduction 



The PCP theorem [XSMllALM+ 98] says that every language in NP can be verified by a polynomial- 
time verifier that uses 0(log n) random bits and queries the proof in a constant number of locations. 
The verifier is guaranteed to always accept a correct proof, and to accept a false proof with bounded 
probability (called the soundness error). Following the proof of the PCP theorem, research has 
been directed towards strengthening the PCP theorem in terms of the important parameters, such 
as the proof length, the number of queries, and the soundness error. 

In parallel, there is a line of work attempting to expand the variety of techniques at our disposal 
for constructing PCPs. Here the aim is to gain a deeper and more intuitive understanding of why 
PCP theorems hold. One of the threads in this direction is replacing algebraic constructions by 
combinatorial ones. This is motivated by the intuition that algebra is not an essential component 
of PCPs, indeed the definition of PCPs involves no algebra at all. Of course, one may also hope 
that the discovery of new techniques may lead to new results. 

For the "basic" PCP theorem |AS981 [ALM"'"98 there have been alternative combinatorial proofs 



|DR06t[Din07] . It is still a challenge to match stronger PCP theorems with combinatorial construc- 
tions. Such is the work of the second author |Mei09| on PCPs with efficient verifiers. In this paper 
we seek to do so for PCPs in the small soundness error regime. 

In this work we give a new construction of a PCP with sub-constant soundness error and two 
queries. This setting is particularly important for inapproximability, as will be discussed shortly 
below. Formally, we prove 

Theorem 1.1 (Two-query PCP with small soundness). Every language L € NP has a two-query 
PCP system with perfect completeness, soundness error 1/polylogn and alphabet size 2^°^^^°^"". 
Furthermore, the verifier in this PCP system makes only 'projection' queries. 

This theorem matches the parameters of the folklore "manifold vs. point" construction which 
has been the only construction in the literature for this parameter range. The technical heart of 
that construction is a sub-constant error low degree test [RS971 IAS03] , see full details in [MR08] . 

Our proof of Theorem II. II is based on the elegant derandomized direct product test of |IKW09] . 
In a nutshell, our construction is based on applying this test to obtain a "derandomized parallel 
repetition theorem". While it is not clear how to do this for an arbitrary PCP, it turns out to be 
possible for PCPs with certain structure. We show how to convert any PCP to a PCP with the 
required structure, and then prove a "derandomized parallel repetition theorem" for such PCPs, 
thereby getting Theorem II. 11 The derandomized parallel repetition theorem relies on a reduction 
from the derandomized direct product test of |IKW09] . 

The Moshkovitz-Raz Construction. Recently, Moshkovitz and Raz [MR08] constructed even 
stronger PCPs. They showed how to obtain PCPs with nearly linear proof length and two queries, 
sub-constant error probability, with any alphabet size smaller than 2?°^^^°^'^, at the expense of 
a suitable increase in the soundness error. Being able to reduce the alphabet size has strong 
consequences for inapproximability, see |MR08| for details. The technique of |MR08| (as evident in 
the later simplification of |DH09] ) is essentially based on composition of certain PCP constructs. 
In fact, their main building block is the "manifold vs. point" construction mentioned above. 

Our construction can be extended to yield a so-called decodable PCP |DII09| . which is an 
object slightly stronger than a PCP. This can be plugged into the scheme of jDH09] to give a 
nearl50 combinatorial proof of the following result of |MR08] . Namely, 



^It is debatable whether our use of "hnear structure" disquahfies the result from being considered purely combi- 
natorial. 
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Theorem 1.2 ( [MR08) ). For any function e{n) > 1/polylogn the class NP has a two-query PCP 
verifier that uses O(logn) random bits, has perfect completeness and soundness error at most e 
over alphabet S of size at most |S| < 2^/^°^^^^'> . 

We note that the result of |MR08j is in fact even stronger than claimed above since their verifier 
uses (1 + 0(1)) logn random bits, see also Remark l6.27[ 

Organization of the introduction In the following sections three sections we outline the back- 
ground and main ideas of this work. We start by describing the parallel repetition technique in 
general and its relation with direct product tests. We proceed to describe our technique of deran- 
domized parallel repetition. We then describe our notion of "PCPs with linear structure" , to which 
the derandomized parallel repetition is applied. 

After the foregoing outline, we discuss relevant works and possible future directions, and describe 
the organization of this work. 

Parallel repetition and Direct Products 

A natural approach to reducing the soundness error of a PCP verifier is by running it several times 
independently, and accepting only if all runs accept. This is called sequential repetition. Obviously, 
if the verifier is invoked k times the soundness error drops exponentially in k. However, the total 
number of queries made into the proof grows /c-fold, and in particular, it is greater than 2. Since our 
focus is on constructing PCPs that make only two queries, we can not afford sequential repetition. 

In order to decrease the soundness error while maintaining the query complexity, one may 
use parallel repetition. For the rest of this discussion, we consider only PCPs that use only two 
queries. Let us briefly recall what parallel repetition means in this context. As in the case of 
sequential repetition, one starts out with a PCP with constant soundness error, and then amplifies 
the rejection probability by repetition of the verifier. However, in order to save on queries, the 
prover is expected to give the /c-wise direct product encoding of the original proof. Formally, if 
TT : [n] — )• E describes the original proof then its direct product encoding, denoted by vr®*^, is the 
function vr®^ : [n]^ ^ TJ^ defined by 

7r^''(xi, . . . , Xfc) = (7r(xi), . . . , TT{Xk)). 

The new verifier will simulate the original verifier on k independent runs, but will read only two 
symbols from the new proof, which together contain answers to k independent runs of the original 
verifier. 

Of course, there is no a priori guarantee that the given proof is a direct product encoding vr'^'^ 
of any underlying proof vr, as intended in the construction. This is the main difficulty in proving 
the celebrated parallel repetition due to Raz |Raz98j that shows that the the soundness error does 
go down exponentially with k. 

One may try to circumvent the difficulty in analyzing the parallel repetition theorem by aug- 
menting it with a direct product test. That is, making the verifier test that the given proof H is 
a direct product encoding of some string vr, and only then running the original parallel repetition 
verifier. This can sometimes be done without even incurring extra queries. Motivated by this 
approach Goldreich and Safra [GSOO] suggested and studied the following question: 

DP testing: Given a function F : [n]'^ ^ S'^ test that it is close to f®^ for some / : [n] — > S. 
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Let us now describe a two query direct product test. From now on let us make the simplifying 
assumption that the function F : [n]*^ — )• S'^ to be tested is given as a function of A;-sized subsets 
rather than tuples, meaning that F{xi, . . . , Xk) is the same for any permutation of xi, . . . , Xk- The 
test chooses two random fc-subsets -61,-62 G ('^') that intersect on a subset A = BinB2 of a certain 
prescribed size and accept if and only if F (Bi)^^ = -F(-B2)j^. This test was analyzed further in 
several works, see [GSOOl IDR061 IDGOSi HKWOQ] . 

Derandomized Direct Product Testing 

Recall that our goal is to construct PCPs with sub-constant soundness error. Note, however, that 
since the parallel repetition increases the proof length exponentially in k (and the randomness of 
the verifier grows fc-fold) , one can only afford to make a constant number of repetitions if one wishes 
to maintain polynomial proof length. On the other hand, obtaining sub-constant soundness error 
requires a super-constant number of repetitions. 

This leads to the derandomization question, addressed already 15 years ago }FK95j . Can one 
recycle randomness of the verifier in the parallel repetition scheme without losing too much in 
soundness error? 

Motivated by this question, Impagliazzo, Kabanets, and Wigderson } IKW09j introduced an ex- 
cellent method for analyzing the direct product test which allowed them to derandomize it. Namely, 
they exhibited a relatively small collection of subsets /C C (^^') , and considered the restriction of the 
direct product encoding f®'' to this collection. They then showed that this form of derandomized 
direct product can be tested using the above test. The collection /C is as follows: identify [n] with 
a vector space F™, let k = \¥\'^ for constant d, and let /C be the set of all d-dimensional linear 
subspaces. 

A natural next step is to use the derandomized direct product of |IKW09| to obtain a deran- 
domized parallel repetition theorem. Recall that the parallel repetition verifier works by simulating 
k independent runs of the original verifier on vr, and querying the (supposed) direct product 11 on 
the resulting A:-tuples of queries. However, in the derandomized setting, the fc-tuples of queries 
generated by the verifier may fall outside /C. This is the main difficulty that we address in this 
work. 

This is where the structure of the PCP comes to our aid. We show that for PCPs with a 
certain linear structure, the fc-tuples of queries can be made in a way that is compatible with the 
derandomized direct product test of |IKW09] . This allows us to prove a derandomized parallel 
repetition theorem for the particular case of PCPs with linear structure. Our main theorem is 
proved by constructing PCPs with linear structure (discussed next), and applying the derandomized 
parallel repetition theorem. 

PCPs with Linear Structure 

We turn to discuss PCPs with linear structure. The underlying graph structure of a two-query PCP 
is a graph defined as follows. The vertices are the proof coordinates, and the edges correspond to all 
possible query pairs of the verifier. (See also Section [2. 3p . We say that a graph has linear structure 
if the vertices can be identified with a vector space F"* and the edges, which clearly can be viewed 
as a subset of F^™', form a linear subspace of F^™ (see also Definition 13. ip . A two-query PCP has 
linear structure if its underlying graph has linear structure. 

As mentioned above, an additional contribution of this work is the construction of PCPs with 
linear structure. That is, we prove the following result. 
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Theorem 1.3 (PCPs with hnear structure). Every language L E NP has a PCP system with 
linear structure, using O(logn) randomness, constant alphabet size, and such that the PCP has 
perfect completeness and soundness error 1 — 1/polylogn. 

We beheve that Theorem 11.31 is interesting in its own right: For known PCPs, the underly- 
ing graph structure is quite difhcuh to describe, mostly due to the fact that PCP constructions 
are invariably based on composition. In principle, however, the fact that a PCP is a "complex" 
object need not prevent the underlying graph from being simple. In analogy, certain Ramanujan 
expanders |LPS88| are Cayley graphs that are very easy to describe, even if the proof of their 
expansion is not quite so easy. It is therefore interesting to study whether there exist PCPs with 
simple underlying graphs. 

Philosophically, the more structured the PCP, the stronger is the implied statement about the 
class NP, and the easier it is to exploit for applications. Indeed, the structure of a PCP system 
has been used in several previous works. For example, Khot constructs |Kho06| a PCP with quasi- 
random structure in order to establish the hardness of minimum bisection. Dinur |Din07j imposes 
an expansion structure on a PCP to obtain amplification. 

We prove Theorem 11.31 by embedding a given PCP into the de Bruijn graph and relying on the 
algebraic structure of this graph. We remark that the de Bruijn graph has been used in constructions 
of PCPs before, e.g. |PS94[ [BFLS91] . in similar contexts. We believe that structured PCPs are 
an object worthy of further study. One may view their applicability towards proving Theorem ll.il 
as supporting evidence. An interesting question which we leave open is whether Theorem 11.31 can 
be strengthened so as to get constant soundness error. By simply plugging such a PCP into our 
derandomized parallel repetition theorem one would get a direct proof of the aforementioned result 
of [MR08| . without using two-query composition. 

Decodable PCPs 

We extend our results to also yield a new construction of decodable PCPs (dPCPs). A dPCP gives 
a way to encode NP witnesses so that a verifier (called a decoder in this context) is able to both 
locally test their validity as well as to locally decode bits from the encoded NP witness. Decodable 
PCPs were introduced in |DH09j towards simplifying and modularizing the work of |MR08j on 
two-query PCPs with small soundness. In |DH09) the result of |MR08| was reproved assuming the 
existence of two building blocks, a PCP and a dPCP, that can be constructed arbitrarily. Until 
this work there has been only one known construction of a dPCP, based on the manifold vs. point 
construction. In this work we give a new construction of a dPCP which is obtained by applying 
derandomized parallel repetition in an analogous way to Theorem ll.il We prove. 

Theorem 1.4 (dPCP, informal version). The class NP has a two-query PCP decoder with proof 
alphabet 2^°^^^°^"', and randomness r{n) < O(logn). The PCP decoder has perfect completeness 
and list-decoding soundness with soundness error 1/polylogn and list size poly log n. 

In order to prove this theorem we generalize each of the steps of the proof of Theorem 11.11 
First we construct a dPCP with linear structure but with relatively high soundness error in an 
analogous way to our proof of Theorem 11.31 Next, we apply derandomized parallel repetition to 
get the desired dPCP. 

An additional contribution of this work is an extension of the definitions of |DH09] of dPCPs 
that work with low soundness error to one that works with high soundness error. This is necessary 
because plugging in a higher value for the soundness error parameter into the existing definition 
of |DH09] turns out to be useless. Instead, we give a variant which we call uniquely decodable 
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PCPs (udPCPs). We show that udPCPs are in fact equivalent to PCPs of Proximity (PCPPs). 
This allows us to rely on known constructions of PCPPs |BGHSV06t IDR06] as our starting point. 
For more details see Section [6.2i 

Together, Theorem 1 1 . 1 1 and Theorem 11.41 imply Theorem 11.21 This is sketched in Section [6.51 

Related Work and Future directions 

Our final construction of a two-query PCP has exponential relation between the alphabet size 
(which is |E| < 2P°iy'°g") and the error probability (which is e ~ l/polylog|S| > 1/polylogn). In 
general, one can hope for a polynomial relation, and this is the so-called "sliding scale" conjecture 
of |BGLR93] . Our approach is inherently limited to an exponential relation both because of a lower 
bound on direct product testing from |DG08) . and, more generally, because of the following lower 
bound of Feige and Kilian [FK95j on parallel repetition of games. Feige and Kilian prove that for 
every PCP system and k = O(logn), if one insists on the parallel repetition using only O(logn) 
random bits, then the soundness error must be at least 1/polylogn (and not l/poly(n) as one 
might hope). Our work matches the |FK95j lower bound by exhibiting a derandomized parallel 
repetition theorem, albeit only for PCPs with linear structure, that achieves a matching upper 
bound of 1/polylogn on the soundness error. 

Nevertheless, for three queries we are in a completely diff'erent ball-game, and no lower bound 
is known. It would be interesting to find a derandomized direct product test with three queries 
with lower soundness error, and to try and adapt it to a PCP. We note that there are "algebraic" 
constructions [RS971 |DFK^99] that make only three queries and have much better relationship 
between the error and the alphabet size. 

It has already been mentioned that while our result matches the soundness error and alphabet 
size of the |MR08] result, it does not attain nearly linear proof length. Improving our result in this 
respect is another interesting direction. 

Organization 

In Section [21 we give the required preliminaries for this work, including a description of the deran- 
domized direct product test of |IKW09| . In Section [3] we prove Theorem 11.11 The proof is based on 
two main steps, described in the next two sections. The construction of PCPs with linear structure 
is given in Section [Jj Then, in Section [5] we prove the "derandomized parallel repetition" theorem 
for PCPs with linear structure, by reducing it to the analysis of a specialized variant of the test 
of |IKW09) . 

The second part of the paper adapts our PCP construction to a dPCP. In Section [6] we discuss 
and define dPCPs, prove Theorem 11. 4[ and sketch a proof of Theorem 11.21 The two main steps 
in the proof of Theorem 11.41 are described in Sections [7] and [8] and are analogous to the two main 
steps of proving Theorem 11.11 as described in Sections HI and [5j Finally, we analyze the specialized 
direct product test (called the S-test) in Section [H 

2 Preliminaries 

Let g ■ U — )• S be an arbitrary function, and let j4 C C/ be a subset. We denote by g^j^ the restriction 

of g (as a function) to A. Given two functions f,g:U^T,we denote f ^ g [f g) to mean that 
they differ on at most (more than) a fraction of the elements of U. 

We refer to a d-dimensional linear subspace of an underlying vector space simply as a d-subspace. 
For two linear subspaces Ai and A2 we denote by Ai + A2 the smallest linear subspace containing 
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1. Choose a uniformly distributed di-subspace B C F"^. 

2. Choose a uniformly distributed do-subspace A Q B. 

3. Accept if and only if U (B)^^ = U{A). 

Figure 1: The P-test 

both of them. We say that Ai,A2 are disjoint if and only if Ai D A2 = {0}. If Ai and A2 are 
disjoint, we use Ai © A2 to denote ^1+^2- 

Let G = {V, E) be a directed graph. For each edge e € E we denote by left (e) and right (e) the 
left and right endpoints of e respectively. That is, if we view the edge e & E as a pair in V x V, 
then left (e) and right (e) are the first and second elements of the pair e respectively. Given a set 
of edges Eq C E, we denote by left (E'o) and right(£^o) the set of left endpoints and right endpoints 
of the edges in Eq respectively. 



2.1 Direct product testing I jlKWOQ] 



Let us briefly describe the setting in which we use the derandomized direct product test of jIKW09) . 
In |IKW09j the main derandomized direct product test is a so-called "V-test". We consider a 
variation of this test that appears in |IKW09t Section 6.3] to which we refer as the "P-test" (P for 
projection). 

Given a string vr G S^, we deflne its (derandomized) P-direct product 11 as follows: We identify 
[i] with F"^, where F is a finite field and m G N, and think of vr as an assignment that maps the 
points in F™" to S. We also fix do < di £ N. Now, we define to be 11 the assignment that assigns 
each do- and di-subspace W of F"* to the function n^]^ : — >■ S (recall that 7r|^ is the restriction 
of TT to W). 

We now consider the task of testing whether a given assignment 11 is the P-direct product of 
some string vr : F"^ — > S. In those settings, we are given an assignment to subspaces, i.e. a function 
n that on input a do-subspace A C F"* (respectively di-subspace B C F'"), answers with a function 
a : A ^ T, (respectively, b : F™ — )• S). We wish to test whether 11 is a P-direct product of some 
vr : F™ — )• S, and to this end we invoke the P-test, described in Figured) 

It is easy to see that if 11 is a P-direct product then the P-test always accepts. Furthermore, 
it can be shown that if 11 is "far" from being a P-direct product, then the P-test rejects with high 
probability. Formally, we have the following result. 

Theorem 2.1 ( |IKW09| ). There exists a universal constant h & N such that the following holds: 

Let e > h ■ do ■ |F|~'^''^'', a'= h ■ do ■ |F|~'^°^'^. Assume that di > h ■ do, m > h ■ di. Suppose that an 
assignment II passes the P-test with probability at least e. Then, there exists an assignment vr such 
that 

'n(S)^ = n(A) andn(S)S7r|B andn(^)S^|^ = ^{e^) (1) 



Pr 



where the probability is over A, B chosen as in the P-test. 

Theorem 12.11 can be proved using the techniques of [IK W09| . For completeness, the proof is 
given in Appendix 1X1 

Working with randomized assignments. As noticed by |IKW09) . Theorem 12.11 works in even 
stronger settings. Suppose that 11 is a randomized function, i.e., a function of both its input and 
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some additional randomness. Then, Theorem 12.11 still holds for IT, where the probability in ([T]) is 
over both the choice of A and B, and over the internal randomness ofH. We will rely on this fact 
in a crucial way in this work. 



2.2 Sampling tools 

The following is a standard definition, in graph terms, see e.g. |IJKW08] . 

Definition 2.2 (Sampler Graph). A bipartite graph G = {L,R,E) is said to be an (e, (5)-sampler 
if, for every function / : L — > [0, 1], there are at most 6 \R\ vertices u (z R for which 

\KeN(u)[f{v)]-KeL[f{v)]\ > e. 

Observe that if G is an (e, 5)-sampler, and \l F d L, then by considering the function / = 1^? we 
get that there are at most 5\R\ vertices G i? for which 



Pr [v eF]- Pr [v G F] 



> e. 



We have the following result 



Lemma 2.3 (Subspace-point sampler [IJKW08] ). Let d' < d be natural numbers, let V be a 
linear space over a finite field ¥, and let W be a fixed d' -dimensional of V . Let G be the bipartite 
graph whose left vertices are all points V and whose right vertices are all d-subspaces of V that 
contain W . We place an edge between a d-subspace X and x (z V iff x & X . Then G is an 
{t + ^^^^ ^^^d^hr;^) -sampler for every r > 0. 



Proof Fix a function f : V [0,1]- We show that for a uniformly distributed d-subspace X 

|F|' 

1 



that contains W it holds with probability at least 1 — ,^^^_J_2 — - that 



\^.ex [fix)]-E,^v[fiv)]\<r+ 

Let be a fixed subspace of V for which V = W ® W. Let fw ■ W ^ [0, 1] be the function 
that maps each vector W of W to E^^w^w [fi'v]], and observe that K^^y [f{v)] = E— ^pp [/w^(w^)]- 
Furthermore, observe that every d-subspace X that contains W can be written as X = W (B U 
where C/ is a (d — (i')-subspace of W, and moreover that Kx£x[f{x)] = Eu^u [fwiu)]. Thus, it 
suffices to prove that for a uniformly distributed {d — d')-subspace U of it holds with probability 
at least 1 . 3 ., — - that 

K^u [fw{u)] - E_g^ [fw{w)]\ <T + (2) 

\-^\d — d' -I 

To that end, let ?7 be a uniformly distributed (d — d )-subspace of W. Let 5i be a set of Q 



|F|-1 

vectors of U such that every two vectors in 5i are linearly independent (it is easy to construct such 
a set). For every a g¥* let Sa be the set obtained by multiplying every vector in Si by a. Observe 
that all the sets Sa have the property that every two vectors in Sa are linearly independent, and 
that the sets Sa form a partition of f7\{0}. We will show that for every a G F* it holds with 
probability at least 1 — — - that 

|E«e5. ifwiu)] - E_g^ [fwinJ)]\ < r 
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and the required result will follow by taking the union bound over all a E F*, and by noting that 
the vector contributes at most j"^^, to the difference in Inequality [51 

Fix a € F*, and let si, . . . ,sq be the vectors in Sa- It is a known fact that si, . . . ,sq are 
pair-wise independent and uniformly distributed vectors of W (over the random choice of U). 
This implies that fw{si), • • • , fwisq) are pair-wise independent random variables with expectation 
E— gpj7 [/vi/(w^)]) and therefore by the Chebyshev inequality it follows that 



Pr 



1 _ 

n^fwisi)- E-g-gF [fw{w)] 



> T 



< 



< 



as required. 



2.3 Constraint graphs and PCPs 

As discussed in the introduction, the focus of this work is on claims that can be verified by reading 
a small number of symbols of the proof. A PCP system for a language L is an oracle machine M, 
called a verifier, that has oracle access to a proof vr over an alphabet S. The verifier M reads the 
input X, tosses r coins, makes at most q "oracle" queries into vr, and then accepts or rejects. If x 
is in the language then it is required that M accepts with probability 1 for some vr, and otherwise 
it is required that M accepts with probabiltiy at most e for every vr. More formally: 

Definition 2.4. Let r, g : N — )• N, and let S be a function that maps the natural numbers to finite 
alphabets. A {r,q)j.-PCP verifier M is a probabilistic polynomial time oracle machine that when 
given input x E {0,1}*, tosses at most coins, makes at most non-adaptive queries to 

an oracle that is a string over S(|a;|), and outputs either "accept" or "reject". We refer to r, q, and 
E as the randomness complexity, query complexity, and proof alphabet of the verifier respectively. 

Remark 2.5. Note that for an (r, g)j-;-PCP verifier M and an input x, we can assume without loss 
of generality that the oracle is a string of length at most 2''(l^l) • since this is the maximal 

number of different queries that M can make. 

Definition 2.6. Let r, q and S be as in Definition [231 let L C {0,1}* and let e : N ^ [0,1). 
We say that L E PCPs,s [f,Q] if there exists an (r, g)j^-PCP verifier M that satisfies the following 
requirements: 

• Completeness: For every x (z L, there exists vr E S (|x|)* such that Pr [M'^(x) accepts] = 1. 

• Soundness: For every x ^ L and for every vr E S (|x|)* it holds that Pr [M'^(x) accepts] < e. 

One possible formulation of the the PCP theorem is as follows. 

Theorem 2.7 (PCP Theorem jAS981 IALM+ 98]). There exist universal constant e E (0,1) and a 
finite alphabet S such that NP C PCPe^s [0(logn),2]. 

PCPs that have query complexity 2 correspond to graphs in a natural way: Consider the action 
of an (r, 2)2-verifier M on some fixed string x, and let r =^ r(|x|),S =^ S(|x|). The verifier M 
is given access to some proof string vr of length £, and may make 2^ possible tests on this string, 
where each such test consists of making two queries to vr and deciding according to the answers. 
We now view the action of M as a graph in the following way. We consider the graph G whose 
vertices are the coordinates in [I], and that has an edge for each possible test of the verifier M. The 
endpoints of an edge e of G are the coordinates that are queried by M in the test that corresponds 
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to e. We also associate an edge e with a constraint Ce G S x S, which contains all the pairs of 
answers that make M accept when performing the test that corresponds to e. We think of vr as 
an assignment that assigns the vertices of G values in S, and say that vr satisfies an edge {u^v) if 
(7r(n), 7r(T;)) G C(u^„). If x € L, then it is required that there exists some assignment vr that satisfies 
all the edges of G, and otherwise it is required that every assignment satisfies at most e fraction of 
the edges. This correspondence is called the FGLSS correspondence [FGL"'"96] . We turn to state 
it formally: 

Definition 2.8 (Constraint graph). A (directed) constraint graph is a directed graph G = {V,E) 
together with an alphabet S, and, for each edge ( ti, f) € E ^ a binary constraint c^^v 
The size of G is the number of edges of G. The graph is said to have projection constraints if 
every constraint Cu^v has an associated function fu,v '■ ^ — ^ ^ such that c^^y is satisfied by (a, b) iff 
/«,-u(a) = h. 

Given an assignment vr : y — > S, we define 

SAT(G',7r)= Pr [{ti{u),t:{v)) & Cu,v\ and SAT(G) = max(SAT(G, ^)). 

{u,v)£E ' T 

We also denote UNSAT(G,^) = 1 - SAT(G,^) and similarly UNSAT(G) = 1 - SAT(G). 

Remark 2.9. Note that Definition 12.81 uses directed graphs, while the common definition of con- 
straint graphs refers to undirected graphs. 

Remark 2.10. Note that if the graph G is bipartite and all edges are directed from, say, left to 
right, then this is simply a label cover instance with projection constraints jAL96]. 



Proposition 2.11 (FGLSS correspondence FGL^96 ]). The following two statements are equiva- 
lent: 

• LGPCP,,s[r,2]. 

• There exists a polynomial-time transformation that transforms strings x G {0, 1}* to con- 
straint graphs Gx of size 2''(l^l^ with alphabet S (|x|) such that: (1) if x G L then SAT(Gx-) = 1, 
and (2) if x ^ L then SAT(G'^) < e. 

Given a POP system for L, we refer to the corresponding family of graphs {Gx} where x ranges over 
all possible instances as its underlying graph family. If the graphs {Gx} have projection constraints 
then we say that the POP system has the projection property. 

Using the |FGL^96] correspondence, we can rephrase the PCP theorem in the terminology of 
constraint graphs: 

Theorem 2.12 (PCP Theorem for constraint graphs). There exist universal constant e € (0,1) 
and a finite alphabet S such that for every language L E NP the following holds: There exists a 
polynomial time reduction that on input x G {0,1}*, outputs a constraint graph Gx such that if 
X (z L then SAT(Gx) = 1 and otherwise SAT{Gx) < £■ 



2.4 Basic facts about random subspaces 

In this section we present two useful propositions about random subspaces. The following propo- 
sition says that a uniformly distributed subspace is disjoint from every fixed subspace with high 
probability. 
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Proposition 2.13. Let d,d' G N such that d > 2d', and let V be a d- dimensional space. Let Wi 
he a uniformly distributed d' -sub space ofV, and let W2 he a fixed d'-subspace ofV. Then, 



Ft[Wi nW2 = {0}] >l-2-d'/\¥ 



\d-2-a 



Proof Suppose that Wi is chosen by choosing random basis vectors vi,...,V(i' one after the other. 
It is easy to see that Wi n W2 7^ {0} only if Vi € span U {vi, . . . for some i € [d']. 

For each fixed i, the vector Vi is uniformly distributed in y\span{t;i, . . . ,Vi-i}, and therefore the 
probability that Vi € span {W2 U {vi, . . . , f for a fixed i is at most 



|span(W2U{7;i,...,t;i_i})| |F| 



d'+i-l 



|y\span{fi, . . .,Vi-i}\ 



< ' ' . (3) 
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where Inequality [3] can be observed by noting that |Fp ^ < [F]'^ ^ < A • jFj'^. By the union bound 



the probability that this event occurs for some i G [d'] is at most — jzj:^^- It follows that the 



|F| 



probability that Wi fl W2 7^ {0} is at most — d~2-d' required 



The following proposition says that the span of d' uniformly distributed vectors is with high 
probability a uniformly distributed d'-subspace. 

Proposition 2.14. Let V be a d-dimensional space over a finite field ¥, let wi, . . . , w^' be indepen- 
dent and uniformly distributed vectors ofV, and let W = span{wi, . . . , Wd'}- Then, with probability 
at least 1 — d' / \¥\'^~'^ it holds that dimW = d' . Furthermore, conditioned on the latter event, W 
is a uniformly distributed d'-subspace ofV. 

Proof The fact that dim = d' with probability at least 1 — d'/ |F|^~°' can be proved in essentially 
the same way as Proposition I2.13[ To see that conditioned on the latter event it holds that 
the subspace W is uniformly distributed, observe that since wi,. . . jWd' were originally chosen to 
be uniformly distributed, all the possible d'-sets of linearly independent vectors have the same 
probability to occur. ■ 

Finally, the following proposition shows the equivalence of two different ways of choosing sub- 
spaces Ai,A2 C S where Ai and A2 are disjoint. 

Proposition. Let V be a linear space over a finite field ¥, and let do,di G N be such that do < 
di < dimV . The following two distributions over d^-subspaces Ai, A2 and a di-subspace B are the 
same: 

1. Choose B to be a uniformly distributed di-subspace of V , and then choose Ai and A2 to he 
two uniformly distributed and disjoint do-subspaces of B. 

2. Choose A\ and A2 to be two uniformly distributed and disjoint do-subspaces of V , and then 
choose B to be a uniformly distributed di-subspace of V that contains Ai and A2. 
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Proof Observe that choosing Ai, A2, B under the first distribution amounts to choosing di uni- 
formly distributed and linearly independent vectors in V (those vectors will serve as the basis of 
B), and then choosing two disjoint subsets of those vectors to serve as the basis of Ai and as the 
basis of A2. On the other hand, choosing Ai, A2 and B under the second distribution amounts 
to choosing do Tiniformly distribiited and linearly independent vectors in V to serve as the basis of 
Ai, then choosing another do uniformly distributed and linearly independent vectors in V to serve 
as the basis of A2 while making sure that this basis is also linearly independent from the basis of 
Ai, and then completing the basis of Ai and the basis of A2 to a basis of B. It is easy to see that 
those two distributions over a set of di vectors and its two disjoint subsets are identical. ■ 

2.5 Similarity of distributions 

In this section we introduce a notion of "similarity of distributions" , which we will use in the second 
part of the paper. Let Xi and X2 be two random variables that take values from a set X, and let 
7 G (0, 1]. We say that Xi and X2 are 7-similar if for every x e X it holds that 

7 • Pr [Xi = x] < Pr [X2 = x] < ^ ■ Pr [Xi = x] 

Note that if Xi and X2 are 7-similar then actually it holds for every for every S C Af that 

7 • Pr [Xi G S] < Pr [X2 G 5] < - • Pr [Xi G S] 

7 

The following claim says roughly that if / is a randomized function, then the random variable 
f{Xi) is 7-similar to f{X2). 

Claim 2.15. Let Xi and X2 be two random variables that take values from a set X that are 7- 
similar. Let Yi and Y2 he two random variables that take values from a set y such that for every 
X E X, y E y it holds that 

Pr [Yi = =x]=Pt [Y2 = y\X2 = x] 
Then, the variables Yi, Y2 are ^-similar. 
Proof It holds that 

Pr[Yi=y] = J2Pv[Yi = y\Xi=x]-PT[Xi=x] 
= ^ Pr [Y2 = y\X2 = x]-Pt [Xi = x] 
> 5^ Pr [Y2 = y\X2 = x] • 7 • Pr [X2 = x] 

= 7-Pr[y2 = y] 

Similarly it can be proved that Pr [^i = y] < ^ • Pr [Y2 = y]. ■ 

2.6 Expanders 

Expanders are graphs with certain properties that make them extremely useful for many appli- 
cations in theoretical computer science. Below we give a definition of expanders that suits our 
needs. 
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Definition 2.16. Let G = iV^E) be a d-regular graph. Let E [S,S^ be the set of edges from a 
subset S (ZV to its complement. We say that G has edge expansion h if for every S (^V such that 
IS"! < \V\/2 it holds that 

\E{S,S)\ >h-do-\S\ 

A useful fact is that there exist constant degree expanders over any number of vertices: 

Fact 2.17. There exist do G N and Hq > such that there exists a polynomial-time constructive 
family {Gn}n&^ do-regular graphs Gn on n vertices that have edge expansion ho (such graphs are 
called expanders). 

3 Main theorem 

In this section we prove the main theorem (Theorem ll.ip . To that end, we use the PCP theorem for 
graphs (Theorem 12. 12p to reduce the problem of deciding membership of a string x in the language 
L to the problem of checking the satisfiability of a constraint graph with constant soundness error. 
We then show that every constraint graph can be transformed into one that has "linear structure" , 
defined shortly below. This is done in Lemma 13.21 which directly proves Theorem 11.31 Finally, in 
Lemma 13.31 we prove a derandomized parallel repetition theorem for constraint graphs with linear 
structure. Theorem 11.11 follows by combining the two lemmas. We begin by defining the notion of 
a graph with linear structure. 

Definition 3.1. We say that a directed graph G has a linear structure if it satisfies the following 
conditions: 

1. The vertices of G can he identified with the linear space F™, where ¥ is a finite field and 
m G N. 

2. We identify the set of pairs of vertices (F™)^ with the linear space F^"^. Using this identifi- 
cation, the edges E of G are required to form a linear subspace of F^™ . 

3. We require that left (E) = right (E) = F™. In other words, this means that every vertex of G 
is both the left endpoint of some edge and the right point of some edge. 

The following lemmas are proved in Sections H] and [5] respectively. 

Lemma 3.2 (PCP with Linear Structure). There exists a polynomial time procedure that satisfies 
the following requirements: 

• Input: 

— A constraint graph G of size n over alphabet S . 

— A finite field F of size q. 

• Output: A constraint graph G' = (F™', E') such that the following holds: 

— G' has a linear structure. 

— The size of G' is at most O (g^ • n) . 

— G' has alphabet 

— If G is satisfiable then G' is satisfiable. 
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— // UNSAT (G) > p then UNSAT {G') > n (p^J^ • p) ■ 

Lemma 3.3 (Derandomized Parallel Repetition). There exist a universal constant h and a poly- 
nomial time procedure that satisfy the following requirements: 

• Input: 

— A finite field F of size q 

— A constraint graph G = {¥"^,E) over alphabet S that has a linear structure. 

— A parameter do such that do < m/h'^. 

— A parameter p € (0, 1) such that p > h ■ do ■ q~'^o/h^ 

• Output: A constraint graph G' such that the following holds: 

— G' has size n'^W'). 

— G' has alphabet j]'?'^'''''' . 

— If G is satisfiahle then G' is satisfiable. 

— If SAT (G) < 1 - p then SAT (G') < h ■ do ■ q-'^o/h_ 

— G' has the projection property. 

We turn to prove the main theorem from the above lemmas. 

Theorem (|1.H restated). Every language I G NP has a two-query POP system with perfect 
completeness, soundness error n and alphabet size 2^°'^^°^". Furthermore, the verifier in 

this PCP system makes only 'projection' queries. 

Proof Fix I G NP. We show that I has a two-query PCP system with perfect completeness, 
soundness error 1/polylogn and alphabet size 2^°^^'°^"-, which has the projection property. By the 
FGL"'"96] correspondence (Proposition 12.11]) . it suffices to show a polynomial time procedure that 
on input x G {0, 1}*, outputs a constraint graph G' of size poly (n) such that the following holds: 
If X G L then G' is satisfiable (i.e. SAT(G') = 1), and if x ^ L then SAT(G') < 0(1/ log |x|). The 
procedure begins by transforming x, using the PCP theorem for constraint graphs (Theorem 12. 12p . 
to a constraint graph G of size n = poly such that if x G L then SAT (G) = 1 and if x L then 
SAT (G) < e, where e G [0, 1) is a universal constant that does not depend on x. Let n = poly (|x|) 
be the size of G, and let p = 1 — e. 

Next, the procedure sets q to be the least power of 2 that is at least log (n), and sets F be the 
finite field of size q. Note that q = O(logn). The procedure now invokes Lemma 13.21 on input G 
and F, thus obtaining a new constraint graph Gi. Note that by Lemma 13.21 if UNSAT (G) > p, 
then PI UNSAT {G,)>n ■ p) . 

Finally, the procedure sets do to be an arbitrary constant such that pi > h ■ do ■ q~'^'^l^ . Note 
that this is indeed possible, since logq(l/pi) is a constant that depends only on p. Finally, the 
procedure invokes Lemma 13.31 on input Gi, F, pi, and do, and outputs the resulting constraint 
graph G'. 

It remains to analyze the parameters of G'. By defining p(A;) = k'-'i^-'^o) ^ -^g gg^ that G' has size at 
most p{n) and alphabet S'?"''*"' = T.P^^°sn\ Furthermore, if UNSAT (G) > p, then UNSAT (Gi) > 
pi. Therefore, by Lemma and by the choice of do , it holds that SAT(G') < 0(l/g^(i)). Since 
q > log n, it holds that SAT(G') < 0(1/ log^^^^ n), as required. ■ 
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Remark 3.4. Recall that |MR08| prove a stronger version of the main theorem, saying that for 
every soundness error s > 1/polylogn it holds that NP has a PCP system with soundness s and 
alphabet size exp (poly (1/s)). If one could prove a stronger version of Lemma 13.21 in which the 
soundness of G' is /j/poly (g) and the alphabet size is then the desired stronger version 

would follow using the same proof as above, without using a composition technique as in [MROSj 
IDH09] . 

The reduction described in Theorem 11.11 is polynomial but not nearly-linear size. In fact, the 
construction of graphs with linear structure (Lemma [32]) is nearly linear size (taking an instance of 
size n to an instance of size -n). The part that incurs a polynomial and not nearly-linear blow-up 
is the reduction in Lemma [3.3l that relies on the derandomized direct product. It is possible that a 
more efficient derandomized direct product may lead to a nearly-linear size construction in total. 

4 PCPs with Linear Structure 

In this section we prove Lemma 13.21 which implies Theorem 11.31 by combining it with the PCP 
theorem (Theorem I2.12p . The lemma which says that every constraint graph can be transformed 
into one that has linear structure. To this end, we use a family of structured graphs called de- 
Bruijn graphs. We show that de-Bruijn graphs have linear structure, and that every constraint 
graph can be embedded in some sense on a de-Bruijn graph. This embedding technique is a variant 
of a technique introduced by Babai et. al. |BFLS9l] and Polishchuk and Spielman [PS 94] for 
embedding circuits on de-Bruijn graphs. We begin by defining de-Bruijn graphs. 

Definition 4.1. Let A be a finite alphabet and let m € N. The de Bruijn graph VB/i^m is the 
directed graph whose vertices set is A™ such that each vertex (ai, . . . , q^) S A™ has outgoing edges 
to all the vertices of the form {02, . . . , aj, /3) for (3 € A. 

Remark 4.2. We note that previous works a slightly different notion, the "wrapped de Bruijn 
graph" , which is a layered graph in which the edges between layers are connected as in the de Bruijn 
graph. Also, we note that previous works fixedA to be the binary alphabet, while we we use a general 
alphabet. 

Lemma 13.21 follows easily from the following two propositions. Proposition 14.31 says that 
de Bruijn graphs have linear structure. Proposition 14.41 says that any constraint graph can be 
embedded on a de Bruijn graph. 

Proposition 4.3. Let ¥ be a finite field and let m G N. Then, the de Bruijn graph DBf^m has 
linear structure. 

Proof Items [1] and [3] of the definition of linear structure (Definition 13. ip follow immediately from 
the definition of de Bruijn graphs. To see that Item [2] holds, observe that in order for a tuple in 
F^"^ to be an edge of 'DBf^m-, it only needs to satisfy equality constraints, which are in turn linear 
constraints. Thus, the set of edges of 'DBf^m form a linear subspace of F^"^. ■ 

Proposition 4.4. There exists a polynomial time procedure that satisfies the following require- 
ments: 

• Input: 

— A constraint graph G of size n over alphabet S . 
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— A finite alphabet A. 

— A natural number m such that |A|"^ > 2 • n 

• Output: A constraint graph G' such that the following holds: 

— The underlying graph of G' is the de Bruijn graph VBA^m- 

— The size of G' is \A\^^^ . 

— G' has alphabet 

— If G is satisfiable then G' is satisfiable. 

— If UNSAT (G) > p then UNSAT (G') > !^ (^ ^^^.lU.^ ■ p) ■ 

Lemma [3. 2 1 is obtained by invoking Proposition l4.4l with A = F, m = [log^ (2 • n)] and combining 
it with Proposition 14.31 The rest of this section is devoted to proving Proposition 14.41 ^'^^ is 
organized as follows: In Section 14.11 we give the required background on the routing properties of 
de Bruijn graphs. Then, in Section [4.21 we give an outline of the proof of Proposition 14.41 Finally, 
we give the full proof of the proposition in Section | 



4.1 de Bruijn graphs as routing networks 

The crucial property of de Bruijn graphs that we use is that de Bruijn graph is a permutation 
routing network. To explain the intuition that underlies this notion, let us think of the vertices 
of the de Bruijn graph as computers in a network, such that two computers can communicate 
if and only if they are connected by an edge. Furthermore, sending a message from a computer 
to its neighbor takes one unit of time. Suppose that each computer in the network wishes to 
send a message to some other computer in the network, and furthermore each computer needs to 
receive a message from exactly one computer (that is, the mapping from source computers to target 
computers is a permutation). Then, the routing property of the de Bruijn network says that we 
can find paths in the network that have the following properties: 

1. Each path corresponds to a message that needs to be sent, and goes from the message's source 
computer to its target computer. 

2. If all the messages are sent simultaneously along their corresponding paths, then at each unit 
of time, every computer needs to deal with exactly one message. 

3. The paths are of length exactly 2 • m. This means that if all the messages are sent simultane- 
ously along their corresponding paths, then after 2 • m units of time all the packets will reach 
their destination. 

Formally, this property can be stated as follows. 

Fact 4.5. Let DB/i^^m be a de-Brujin graph. Then, given a permutation n on the vertices ofDB/i^^m 
one can find a set of undirected paths of length I = 2m which connect each vertex v to fi{v) and 
which have the following property: For every j G [I], each vertex v is the j-th vertex of exactly one 
path. Furthermore, finding the paths can be done in time that is polynomial in the size ofDJSp^^'fn- 

Fact 14.51 is proved in |Lei92j for the special case of A = {0, 1}. The proof of the general case 
essentially follows the original proof, except that the looping algorithm of Benes with replaced with 
the decomposition of d-regular graphs to d perfect matchings. For completeness, we give the proof 
of the general case in Appendix iBl 
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Remark 4.6. Note that the paths mentioned in Fact 14.51 are undirected. That is, if a vertex u 
appears immediately after a vertex v in path, then either {u,v) or {v,u) are edges of "DB/i^^m- 

4.2 Proof overview 

Suppose we are given as input a constraint graph G which we want to embed on VB = VB\^m- 
Recall that the size of G is at most lAj™", so we may identify the vertices of G with some of the 
vertices of VB. 

Handling degree 1 As a warm up, assume that G has degree 1, i.e., G is a perfect matching. 
In this case, we construct G' as follows. We choose the alphabet of G' to be for / *== 2m. Fix 
any assignment tt to G. We describe how to construct a corresponding assignment vr' to G' . We 
think of the vertices of G as computers, such that each vertex v wants to send the value ■7t{v) as a 
message to its unique neighbor in G. Using the routing property of the de Bruijn graph, we find 
paths for routing those messages along the edges of G' . Recall that if all the messages are sent 
simultaneously along those paths, then every computer has to deal with one packet at each unit of 
time, for / units of time. We now define the assignment tt' to assign each vertex v G' a tuple in 
E' whose j-th element is the message with which v deals at the j-th unit of time. 

We define the constraints of G' such that they verify that the routing is done correctly. That is, 
if the computer u is supposed to send a message to a vertex v between the j-ih unit of time and the 
(j + l)-th unit of time, then the constraint of the edge betwen u and v checks that vr' (u)j = 7r'(w)j+i. 
Furthermore, for each edge {u, v) of G, the constraints of G' check that the values vr' {v)i and vr' (v)-^ 
satisfy the edge (n, v). This condition should hold because if vr' was constructed correctly according 
to vr then vr' {v)i = vr(n) and vr' (v)^ = vr(u). It should be clear that the constraints of G' "simulate" 
the the constraints of G. 

Handling arbitrary degree graphs Using the expander replacement technique of Papadim- 
itriou and Yannakakis [PY91| . we may assume that G is d-regular for some universal constant d. 
The d-regularity of G implies that the edges of G can be partitioned to d disjoint perfect matchings 
in polynomial time (see, e.g., [Cam98l Proposition 18.1.2]). Now, we set the alphabet 
of G' to be (S') , and handle each of the matchings /ij as before, each time using a "different 
part" of the alphabet symbols. In other words, the alphabet of G' consists of d-tuples of S', and 
so the constraints used to handle each matching //j will refer to the i-th coordinates in those tu- 
ples. Finally, for vertex v, its constraints will also check that the message it sends in each of the 
d routings is the same. In other words, if vr' (v) = (cJi, . . . , cr^) G (S') then the constraints will 
check that {(Ti)^ = ... = (cJd)]^. As before, the constraints of resulting graph G' "simulate" the 
constraints of the original graph G. 

Remark 4.7. Observe that the foregoing proof used only the routing property of de Bruijn graphs, 
and will work for any graph that satisfies this property. In other words, Proposition 14.41 holds for 
any graph for which Fact 14.51 holds. 

4.3 Detailed proof 

We use the following version of the expander-replacement technique of |PY91] . 

Lemma 4.8 ( |Din07t Lemma 3.2]). There exist universal constants c, d G N and a polynomial time 
procedure that when given as input a constraint graph G of size n outputs a constraint graph G' of 
size 2 ■ d - n over alphabet S such that the following holds: 



19 



• G' has 2 • n vertices and is d-regular. 

• If G is satisfiahle then so is G' . 

• // UNSAT (G) > p then UNSAT (C) > p/c. 

We turn to proving Proposition 14.41 When given as input a constraint graph G, a finite al- 
phabet A and a natural number m such that > 2 ■ n, the procedure of Proposition 14.41 acts 
as follows. The procedure begins by invoking Lemma 14.81 on G, resulting in a d-regular constraint 
graph Gi over 2 • n vertices. Then, the vertices of Gi are identified with a subset of the vertices of 
VB = VB^^rn (note that this is possible since |A™| > 2 ■ n). 

Next, the procedure partitions the edges of Gi to d disjoint perfect matchings, and views those 
matchings as permutations pi, . . . ,P(i on the vertices of VB in the following way: Given a vertex 
V of VB, if V is identified with a vertex of Gi then pi maps v to its unique neighbor in G via the 
i-th matchning, and otherwise pi maps v to itself. The procedure then applies Fact 14.51 to each 

permutation pi resulting in a set of paths Vi of length I '= 2m. Let V = l^Vi- 

Finally, the procedure constructs G' in the following way. We set the alphabet of G' to be S' '^, 
viewed as (S') . If a € (S') , and we denote a = (cri, . . . , ad), then we denote by (jjj the element 
(cTi)j € S. To define the constraints of G', let us consider their action on an assignment vr' of G'. 
An edge {u, v) of VB' is associated with the constraint that accepts if and only if all the following 
conditions hold: 

1. For every i € [d], the values ^tt' (n)j ^ ,7r' (u)- satisfy the edge [p~^{u),u) of G. 

2. It holds that vr' (n)^ ^ = . . . = it' (u)^ ^ and that n' {v)^ ^ = . . . = tt' (v)^ i- 

3. For every i G [d] and j E [/ — 1] such that u and t; are the j-th and (j + l)-th vertices of a 
path in p £ Vi respectively, it holds that vr' {u)-j 7^ vr' (w)^ 

4. Same as Condition [3l but when v is the j-th vertex of p and u is its (j + l)-th vertex. 

The size of G' is indeed lAj™"^^, since the graph is |A|-regular and contains lAI*" vertices. Further- 
more, if G is satisfiable, then so is G': The satisfiability of G implies the satisfiability of Gi, so 
there exists a satisfying assignment vri for Gi. We construct a satisfying assignment vr' from vri by 
assigning each vertex f of G' a value vr' (u), such that for each i € [d], v is the j-th vertex of a 
path p G Vi that connects the vertices n and Pi{u), then we set vr' {v)^ ^ = 'ni{u). Note that this is 
well defined, since every vertex is the j-th vertex of exactly one path in Vi- 

It remains to analyze the soundness of G' . Suppose that UNSAT (G) > p. Then, by Lemma [4.81 
it holds that UNSAT (Gi) > p/c. Let vr' be an assignment to G' that minimizes the fraction of 
violated edges of G'. Without loss of generality, we may assume that for every vertex v of the VB 
it holds that tt' {v)^^ = . . . = tt' {v)^ ^: If there is a vertex v that does not match this condition, 
all of the edges attached to v are violated and therefore we can modify the 7r'(f) to match this 
condition without increasing the fraction of violated edges of vr'. Define an assignment vri to Gi by 
setting vri(u) = vr' {v)^ ^ (when v is viewed as a vertex of VB). 

Since UNSAT (Gi) > p/c, it holds that vri violates at least p/c fraction of the edges of Gi, or in 
other words vri violates at least p - 2 ■ n ■ d/ c edges of Gi. Thus, there must exist a permutation pi 
such that vri violates at least p ■ 2 ■ n/c edges of Gi of the form {u,pi{u)). Fix such an edge 
{u,pi{u)) and consider the corresponding path p € Vi. Observe that vr' must violate at least one 
of the edges of p: To see it, note that if vr' would satisfy all the edges on p, then it would imply 
that vr' (piiu)),- 1 = vri(u) and that vr' [pi{u))^ ^ = ■Ki{pi{u)), but the last two values violate the edge 
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{u,jjLi{u)) of Gi, and therefore vr' must violate the last edge of p - contradiction. It follows that for 
each of the p-2-n/c edges of the matching ^Uj that are violated by tti it holds that vr' violates at least 
one edge of their corresponding path. By averaging there must exist j € [/] such that for at least 
p ■ 2 ■ n/ c ■ I edges of the matching pi it holds that vr' violates the j-th edge of their corresponding 
path. 

Now, by the definition of the paths in Pj, no edge of G' can be the j-th edge of two distinct 
paths in "P,, and therefore it follows that there at least p ■ 2 ■ n/ c ■ I edges of G' are violated by vr'. 
Finally, there are |A|'"'''^ edges in G', and this implies that vr' violates a fraction of the edges of G' 
that is at least 

as required. 

5 Derandomized Parallel Repetition of Constraint Graphs with 
Linear Structure 

In this section we prove Lemma 13.31 restated below, by implementing a form of derandomized 
parallel repetition on graphs that have linear structure. 

Lemma 5.1 (j3.31 restated). There exist a universal constant h and a polynomial time procedure 
that satisfy the following requirements: 

• Input: 

— A finite field F of size q 

— A constraint graph G = (F™, E) over alphabet S that has a linear structure. 

— A parameter € N such that do < m/K^ . 

— A parameter p G (0, 1) such that p > h ■ do ■ q~'^'^/^ . 

• Output: A constraint graph G' such that the following holds: 

— G' has size rf^'^^\ 

— G' has alphabet j]'?'^'''''' . 

— If G is satisfiable then G' is satisfiable. 

— If SAT (G) <l-p then SAT (G') < h ■ do ■ q-^o/h^ 

— G' has the projection property 

The basic idea of the proof is as follows. The vertices of G' correspond to small subspaces (i.e. 
O (do)-dimensional subspaces) of the vertices space F™ and of the edges space E. A satisfying as- 
signment n to G' is expected to be constructed in the following way: Take a satisfying assignment vr 
to G. For each vertex of G' which is a subspace A of vertices, the assignment 11 should assign A 
to vr|^. For each vertex of G' which is a subspace F of edges, the assignment 11 should assign F 

to 7r|ieft(^)uright(F)- 

The edges of G' are constructed so as to simulate a test on 11 that is referred to as the "E-test" 
and acts roughly as follows (see Figure [2] for the actual test): Choose a random subspace F of edges 
and a random subspace A of endpoints of F, and accept if and only if the labeling of the endpoints 
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of the edges in F by 11 (F) satisfies the edges and is consistent with the labehng of the vertices of 
A by U{A). 

The intuition that underlies the soundness analysis of G' is the following: The E-test performs 
some form of a "direct product test" on 11, and therefore if Ii{F) is consistent with n(^), the 
labeling 11 (F) should be roughly consistent with some assignment vr to G. Therefore, by checking 
that the labeling 11 (F) satisfies the edges in F, the E-test checks that vr satisfies many edges of vr in 
parallel. In this sense, the E-test can be thought as a form of "derandomized parallel repetition" . 

The rest of this section is organized as follows. In Section 15.11 we provide a formal description 
of the construction of G' and analyze all its parameters except for the soundness. In order to 
analyze the soundness of G' , we introduce in Section [5.21 a specialized direct product test. Finally, 
in Section 15.31 we analyze the soundness of G' by reducing it to the analysis of the specialized direct 
product test. 

Notation 5.2. Given a functions / : J7 — t- S and two subsets S,T CI U we denote by f\{s,T) the 
pair of functions (/|5,/|t)- Given two pairs of functions /i,/2 : {/ — > S and 31,(72 : F —> S, we 

denote by ~ {f2,92) the fact that both /i « /2 and gi w g2, and otherwise we denote 

a 

if 1,91) 7^ (/2,92). 

5.1 The construction of G' 

We begin by describing the construction of G' . Let G = {¥^,E) be the given constraint graph, let 
do be the parameter from Lemma 13.31 and let di = h ■ do where h is the universal constant from 
Lemma 13.31 to be chosen later. The graph G' is bipartite. The right vertices of G' are identified 
with all the 2do-subspaces of F*" (the vertex space of G). The left vertices of G' are identified 
with all the 2di-subspaces of the edge space E of G. An assignment 11 to G' should label each 
2(io-subspace A of F™' with a function from A to S, and each 2(ii-subspace F of E with a function 
that maps the endpoints of the edges in F to S. The edges of G' are constructed such that they 
simulate the action of the "E-test" described in Figure [2l 



1. Let Fl and Fr be random di-subspaces of E, and let 

Bl = left (El) , Br ""^^ right (Fr) , F El + Fr. 

El and Fr are chosen to be uniformly and independently distributed di-subspaces of E 
conditioned on dim(F) = 2di, dim(i?j^) = di, dim(i?/j) = di, and Bl H Br = {0}. 

2. Let Al and Ar be uniformly distributed do-subspaces of Bl and Br respectively, and 
let 

A^^'Al + Ar. 

3. Accept if and only if 11 = U and the assignment 11 (E) satisfies 
the edges in F. 



Figure 2: The E-test 

The completeness of G' is clear. It is also clear that G' has projection constraints. Let us 
verify the size and alphabet-size of G' . The size of G' is at most the number of 2di-subspaces of E 
multiplied by the number of 2(io-subspaces of F*", which is • |]F'"p'^o. it holds that do < di, 

and furthemore the linear structure of G' implies that dim E >m (by Item [3] of Definition 13. ip , so 
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1. Choose two uniformly distributed and disjoint di-subspaces -61,-62 of F™'. 

2. Choose two uniformly distributed do-subspaces Ai Q Bi, A2 Q B2. 

3. Accept if and only if n (-Bi, -B2)|(^^^^^) = IT (Ai + yl2)|(Al,yl2)• 

Figure 3: The S-test 

it follows that |F™|^'^" < \Ef'^^ and thus \Ef'^' ■ \¥"'\'^'^'' < \E\^'^\ Finally, observe that the size of 
G is n = \E\, so it follows that the size of G' is at most n^'^^ = 'nP^'^°\ as required. 

For the alphabet size, recall that an edges subspace F is labeled by a function that maps the 
endpoints of the edges to S. Such a function can be represented by a string in S^'"? ^ , since each 
2di-subspace F contains cp''^^ edges and each has two endpoints. It can be observed similarly that 
the labels assigned by 11 to 2do-subspaces A of can be represented by strings in S^''^ ^ . The 
alphabet of G' is therefore T?''i^ ''^ = 5]'?°^'*°^ , as required. 



5.2 The specialized direct product test 

In order to analyze the soundness of the E-test, we introduce a variant of the direct product test 
of |IKW09j that is specialized to our needs. We refer to this variant as the specialized direct product 
test, abbreviated the "S-test" . 

Given an string vr : F"* — )• S, we define its S-direct product U (with respect to d^^di € N) as 
follows: n assigns each 2(io-subspace A C F™ the function tt^, and assigns each pair of disjoint 
di-subspaces (-61,-62) the pair of functions t^\[Bx,B2)- 

We turn to consider the task of testing whether a given assignment 11 is the S-direct product 
of some string vr : F™ ^ E. In our settings, we are given an assignment 11 that assigns each 
2(io-subspace A to a function a : A — > S and each pair of disjoint di-subspaces (-61,-62) to a pair 
of functions 61 : -Bi ^ S, 62 : -62 ^ S. We wish to check whether 11 is a S-direct product of some 
TT : F*" ^ S. To this end we invoke the S-test, described in Figure [3l 

It is easy to see that if 11 is a S-direct product then the S-test always accepts. Furthermore, 
it can be shown that if 11 is "far" from being a S-direct product, then the S-test rejects with high 
probability. As in the P-test, this holds even if 11 is a randomized assignment. Formally, we have 
the following result. 

Theorem 5.3. There exist universal constants h',c (zf^ such that the following holds: Let do G N, 
di > h' ■ do, and m > h' ■ di, and let e > h' ■ do ■ q^'^o/h' ^ a '= h' ■ do ■ q^'^o/^' . Suppose that a 
(possibly randomized) assignment U passes the S-test with probability at least e. Then there exists 
an assignment vr : F™ S for which the following holds. Let Bi, B2 be uniformly distributed 
and disjoint di-subspaces o/F™, let Ai and A2 be uniformly distributed do-subspaces of Bi and B2 
respectively, and denote A = Ai + A2. Then: 



Pr 



n(-6i,i32)|(^^,^^)=n(A)|(^^^^^) andn(i?i,i?2)S^|(B„BJ =^{el (4) 



|(Ai,A2) - ^M^^KAi.Aa) 

We defer the proof of Theorem 15.31 to Section [9l 

Remark 5.4. Note that Equation |4] only says that 11 is close to the S-direct product of vr on pairs 
(-61,-62), and not necessarily on 2do-subspaces A. In fact, it could be also proved that 11 is close 
to the S-direct product of vr on the 2(io-subspaces, but this is unnecessary for our purposes. 
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5.3 The soundness of the derandomized parallel repetition 

In this section we prove the soundness of G': namely, that if SAT (G) < 1 — then 

SAT(G') <e = h-do- q-'^'^'^ 

where h is the universal constant from Lemma 13.31 We will choose h to be sufficiently large such 
that the various inequalities in the following proof will hold. To this end, we note that throughout 
all the following proof, increasing the choice of h does not break any of our assumptions on /i, so 
we can always choose a larger h to satisfy the required inequalities. 

Let h' and c be the universal constants whose existence is guaranteed by Theorem 15.31 and let a 
denote the corresponding value from Theorem 15. 3i We will choose the constant h to be at least h' . 

Let n be an assignment to G' . Let us denote by T the event in which the E-test accepts H. 
With a slight abuse of notation, for a subspace F C E and an assignment vr : F™' — )• S, we denote 
by n (F) ~ vr the claim that for at least 1 — a fraction of the edges e of F it holds that U (F) is 

a 

consistent with tt on both the endpoints of e, and otherwise we denote H {F) 96 tt. Our proof is 
based on two steps: 

• We will show (in Proposition 15.51 below) that if the test accepts with probability e, then it 
is "because" H is consistent with some underlying assignment vr : F"* — )• S. This is done 
essentially by observing that the E-test "contains" an S-test, and reducing to the analysis of 
the S-test. 

• On the other hand, we will show (in Proposition 15.61 below) that for every assignment tt : 
F"* — )• T, the probability that the test accepts while being consistent with vr is negligible. 
This is done roughly as follows: Any fixed assignment vr is rejected by at least p fraction of 
G's edges. Furthermore, the subspace F queried by the test is approximately a uniformly 
distributed subspace of E, and hence a good sampler of E. It follows F must contain ~ 
p fraction of edges of G that reject tt, and therefore 11 (F) must be inconsistent with vr. 

We have reached a contradiction and therefore conclude that the E-test accepts with probability 
less than e. We now state the two said propositions, which are proved in Sections 15.3.11 and 15.3.21 
respectively. 

Proposition 5.5. There exists = {e"^) such that the following holds: IfPv [T] > e, then there 



exists an assignment vr : F"^ — > S such that Pr 



4-a 



T and n (F) vr 



>eo. 



Proposition 5.6. Let e he as in Lemma \5.5[ Then, for every assignment vr : F"* T, it holds that 



Pr 



r and n (F) vr 



< £0- 



Clearly the two propositions together imply that Pr[7^ < e, as required. 

Before turning to the proofs of Propositionss 15.51 and 15.61 let us state a useful claim that says 
that if we take a random cZ-subspace of edges and project it to its left endpoints (respectively, right 
endpoints) , we get a random cZ-subspace of vertices with high probability. 

Claim 5.7. Let d € N and let Ea be a uniformly distributed d-subspace of E. Then, Pr [dim (left {Ea)) 
1 — d/q™'~'^ , and conditioned on dim (left {Ea)) = d, it holds that left {Ea) is a uniformly distributed 
d-subspace of¥"^. The same holds for right {Ea). 
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More generally, let Eh be a fixed subspace of E such that dim > d and dim (left = 
D > d. Let Ea be a uniformly distributed d-subspace of Eb- Then, Pr [dim (left (E'a)) = d] > 1 — 
d/q^~'^, and conditioned on dim (left (£^a)) = d, it holds that left (-Eq) is a uniformly distributed 
d-subspace of left (Eh) . Again, the same holds for right {Ea) ■ 

We defer the proof of to Appendix [Cl 



5.3.1 Proof of Proposition 15.51 



Suppose that Pr \T] > £■ We prove Proposition 15.51 by arguing that the E-test contains an "implicit 
S-test" and applying Theorem 15. 3i 

Observe that, without loss of generality, we may assume that for every edge-subspace F such 
that n (F) violates one of the edges in F, it holds that 11 (F)^^^ ^ 11 (^)(yi^ y^^) for any choice 
of Al and An. The reason is that for every such F, we can modify H (F) such that it assigns 
symbols outside of the alphabet S of G, so 11 (F) will always disagree with 11 [A). Note that this 
modification indeed does not change the acceptance probability of 11. This assumption that we make 
on n implies in particular that the event T is equivalent to the event 11 (F)^^^ ^ li {A)^j^^ 
and this equivalence is used in the following analysis. 

We turn back to the proof of Proposition 15.51 We begin the proof by extending 11 to pairs of 
disjoint (ii-subspaces of F"* in a randomized manner as follows: Given a pair of disjoint di-subspaces 
Bi and we choose Fi and F2 to be uniformly distributed and disjoint di-subspaces of E such 
that left (Fi) = Bi and right (F2) = B2, and set H (Si, S2) = H (Fi + ^2)|(Bi,b2)- 

Now, observe that the probability that the E-test accepts equals to the probability that the 
S-test accepts the extended 11. The reason is that the subspaces -B^, Br., Al, Ar of the E-test are 
distributed like the subspaces Bi, B2, Ai, Ai of the S-test. It thus follows the E-test performs in 
a way an S-test on the extended assignment 11 . 

Next, we note that by choosing h to be sufficiently large, the foregoing "implicit S-test" matches 
the requirements of Theorem 15.31 s-^icl we can thus apply this theorem. It follows that there exists 
an assignment vr : — > S such that 



Pr 



n(i?L,i?ij) 



n(A)|(^^_^^) andn(i?L,i?R)«7r(B^,B«) > Q (e'=) 



(5) 



By using the equivalence between the event T and the event 11 (F)^^^ 7^ 11 (^)(^^ ^^), it follows 
that Inequality [5] is equivalent to the following inequality. 



Pr 



r and n(F)|(^^ ~ 7r|(B„B«) >^{e'') 



(6) 



We turn to show that 



Pr 



4« 



r and n (F) vr 



We will prove that if F is such that 11 (F) 96 vr, then for a random choice of Bi,Br conditioned 
on F, it is highly unlikely that Inequality [6] still holds. Formally, we will prove the following. 
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Claim 5.8. For every fixed 2dQ-subspace Fq of E such that 11 (Fq) 96 vr, it holds that 



Pr 



n(^)|(ij^,ij^) ~ ■^\{BL,Bn) 



F = Fn 



<1/ 



We defer the proof of Claim 15.81 to the end of this section. Claim 15.81 immediately implies the 
following. 
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Corollary 5.9. It holds that 



Pr 



4a 

n(F) 96 vr 



< 1/ (g'^-^ . (^/2)2) 



By combining Corollary 15.91 with Inequality [6l and by choosing h to be sufficiently large, it follows 
that 



Pr 



4a 



T and n ~ mBL,Bn) and H (F) vr 



>f](e'=), 



This implies that 



Pr 



4a 



r and n (F) vr 



Setting eo to be the latter lower bound finishes the proof. 



4a 



Proof of Claim fS.SI Observe that the assumption 11 (Fq) 96 vr implies that one of the following 
holds 



2a 



n(-^o)|ieft(Fo) ^ ^lleft(Fo) 



2a 



n(^o)|right(Fo) ^ ^lright(Fo) 

Without loss of generality, assume that the first holds. Now, when conditioning on F = Fq, it 
holds that Fl is a uniformly distributed di-subspace of Fq satisfying dim (left (F^,)) = di. By 
Claim [5771 (with Ef, = Fq and Fa = Fl), under the conditioning on dim (left (Fl)) = di, it holds 



def 



that Bl = left (Fl) is a uniformly distributed di-subspace of left (Fq). Therefore, by Lemma [27 

a 

the event n(F)|^^ 96 tt^Bl occurs with probability at least 

2" 



1 - 1/ U' 



>i-i/U' 



A -2 



(a/2)' 



as required. 



5.3.2 Proof of Proposition [576] 

Fix an assignment vr : F™ — t- S. By assumption it holds that SAT (G) < 1 — p, and therefore tt must 
violate a set E* of edges of G of density at least p. Below we will show that at least p/2 fraction 
of the edges in F are in E* with probability greater than 1 — eo- Now, observe that 11 (F) cannot 
satisfy the edges of F and at the same time be consistent with vr on the edges in E*, and hence 

p/2 

whenever the latter event occurs it either holds that the E-test fails or that IT (F) 96 vr. However, 
for sufficiently large choice of h, it holds that p/2 > 4 ■ a, and therefore the probability that the 

4-a 

E-test passes and at the same time it holds that IT (F) ~ vr is less than £q, as required. 
It remains to show that 

P,.fEiip>,/2 



>l-eo 



We prove the above inequality by showing that F is close to being a uniformly distribured 2di- 
subspace of F, and then applying Lemma [2. 3[ To this end, let F^ and F^ be uniformly distributed 
di-subspaces of F, and let F' = F^+F^. Let us denote by £1 the event in which dim (F') = 2di, and 
by £2 the event in which left (F^) and right {F^) are disjoint and are of dimension di. Observe that 
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conditioned on £i and £2 the subspace F' is distributed exactly like the subspace F. It therefore 
holds that 



Pr 



\Fr\E* 

\F\~ 



>p/2 



= Pr 

> Pr 

> Pr 

> Pr 



IF' 


r\E*\ 




F'\ 


\F' 


r\E*\ 




F'\ 


\F' 


r\E*\ 




F'\ 


\F' 


r\E*\ 


\F'\ 



>p/2 



f 1 and £2 
£1 



> p/2 and £2 

> p/2 £1 

> p/2 £1 



Pr b£2] 
Pr [^1] 



Now, observe that conditioned on £1, the subspace F' is a uniformly distributed 2di-subspace of 
E. Thus, by Lemma 12.31 it holds that 



Pr 



\F' n E* 

IF'I 



>p/2 



£1 



> 1 - ■ (p/2 - q 



-2di 



>l_l/g2d,-2.(^/3)i 



Moreover, by Proposition 12. 131 it holds that 

Pr[£:i] > 1 - 2di/g'ii'^^-2di 
> 1 - 2di/g'"-2«!i 



> 



1 



Finally, we upper bound Pr [£"2]. By Claim 15.71 (with Eh = E and Ea = F']^,F'j^) it holds 
that dim (left (F^)) = dim (right (Fjj)) = di with probability at least 1 - 2 • di/g™"'^!. Further- 
more, conditioned on the latter event, it holds that left (F^) and right (F^) are uniformly dis- 
tributed c?i-subspaces of F™, and it is also easy to see that those subspaces are independent. By 
Proposition 12.131 this implies that conditioned on dim (left (F^)) = dim (right (Fjj)) = di the sub- 
spaces left (F^) and right (Fjj) are disjoint with probability at least 1 — 2di/g™'~^ '^^ , and hence 
Pr [^2] > 1 — 4di/g''"~^''^i as required. 

We conclude that that 



Pr 



|FnF* 
IfF 



>p/2 



> Pr 



|F' n E* 

2-di-2 



>p/2 



£1 



Pr [-^2] 



Pr [^1] 
2 4 ■ 

^72 



= 1 - l/g2-'^i-2 . (p/3)2 _ 8 . di/q"'-^-'^' 
> 1 -eo 

where the last inequality holds for sufficiently large choice of h. This concludes the proof. 



6 Decodable PCPs 

The PCP theorem says that CircuitSat has a proof system in which the (randomized) verifier 
reads only 0(1) bits from the proof. In known constructions this proof is invariably an encoding of a 
satisfying assignment to the input circuit. Although this is not stipulated by the classical definition 
of a PCP, the fact that a PCP is really an encoding of a 'standard' NP witness is sometimes useful. 
Various attempts to capture this behavior gave rise to such objects as PCPs of Proximity (PCPPs) 
[BGHSV06] or assignment testers [DR06] . and more recently to decodable PCPs (dPCPs) |DII09] . 
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Application: alphabet reduction through composition. The notion of dPCPs is useful 
for reducing the alphabet size of PCPs with small soundness error via composition. They were 
introduced in |DH09] in an attempt to simplify and modularize the construction of [ MR08j . Indeed 
this notion is a refinement of [MR OBj's so-called "locally decode or reject codes (LDRCs)" which 
allowed |DH09| prove a generic two-query composition theorem. This theorem allows one to improve 
parameters of a PCP using any dPCP. The only known construction of a dPCP (until this work) 
is the so-called "manifold vs. point" construction. In the next sections we give a new construction 
of a dPCP by adapting the work of the previous sections to a dPCP. Our dPCP can then be 
plugged into the composition scheme of [DH09| to reprove the result of |MR08| . We sketch this in 
Section 16. 51 

Decodable PCPs and PCPs of Proximity (PCPPs). We can define dPCPs for any NP 
language but we focus on the language CircuitSat since it suffices for our purposes. A dPCP 
system for CircuitSat is a proof system in which the satisfying assignments of the input circuit 
are encoded into a special "dPCP" format. These encodings can then be both locally verified and 
locally decoded in a probabilistic manner. In other words, the verifier is given an input circuit as 
well as oracle access to a proof string, and is able to simultaneously check that the given string is 
a valid encoding of a satisfying assignment, as well as to decode a symbol in that assignment. The 
formal definition is given below in Section 16.21 

dPCPs are closely related to PCPs of proximity jBGHSV06| or assignment testers |DR06j (to 
be defined shortly below). In fact dPCPs were first defined in the context of low soundness error 
to overcome inherent limitations of PCPPs in this parameter range. In this work we extend the 
definition of a dPCP also to the high soundness error range (i.e. matching the parameter range of 
PCPPs). We call these uniquely decodable PCPs (udPCPs) as opposed to list decodable dPCPs. 
It is natural to consider such an object in our context since our approach is to reduce the error by 
parallel repetition. Thus we must start with a dPCP with relatively high error and then reduce 
the error. Uniquely decodable PCPs turn out to be roughly equivalent to PCPPs in the sense that 
any PCPP can be used to construct a udPCP and vice versa. In retrospect, we find the notion 
of udPCPs (and dPCPs) just as natural as that of PCPPs. In fact, many known constructions of 
PCPPs work by implicitly constructing a udPCP and then adding comparison checks. 

In the following subsections we recall the definitions of PCPPs (Section l6.ip and define udPCPs 
(Section 16. 2p . We then prove the equivalence of PCPPs and udPCPs. Next we state two lemmas 
that capture the two main steps in constructing dPCPs. This is followed by a proof of Theorem 1 1.41 
Finally, we sketch a proof of Theorem 11.21 based on Theorem 11.41 

6.1 Recalling the definition of PCPPs 

PCPs of Proximity (PCPPs) were defined simultaneously in [ BGHSV06j and in |DR06] under 
the name assignment testers. PCPPs allow the verifier to check not only that a given circuit is 
satisfiable, but also that a given assignment is (close to being) satisfying. They were introduced 
for various motivations, and in particular, they facilitate composition of PCPs which is important 
for constructing PCPs with reasonable parameters. 

Intuitively, a PCP verifier for CircuitSat is an oracle machine V that is given as input a 
circuit if : {0, 1}* — ?• {0, 1}, and is also given oracle access to an assignment x to (p and a proof vr. 
The verifier V is required to verify that x is close to a satisfying assignment of 99, and to do so by 
making only few queries to x and vr. For technical reasons, it is often preferable to define y in a 
diff'erent way. In this definition, instead of requiring that V makes few queries to its a oracle and 
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decides according to the answers it gets, we require that V outputs exphcitly the queries it intends 
to make and the predicate ip it intends to apply to the answers it gets. The advantage of this 
definition is that it allows us to measure the complexity of the predicate ip. The formal definitions 
of PCPP are given below. 

Definition 6.1 (PCPP verifier). A PCPP verifier for CircuitSat is a probabilistic polynomial- 
time algorithm V that on input circuit if : {0, 1} {0, 1} of size n tosses r(n) coins and generates 

1. q = q{n) queries / = in [t + 1] (where I = £{n) and the queries are viewed as 
coordinates of a string in {0, l}*"*"^). 

2. A circuit ip : {0, 1}'^ — > {0, 1} of size at most s(n). 

We shall refer to r(n), q{n), £{n), and s(n) as the randomness complexity, query complexity, proof 
length, and decision complexity respectively. 

Definition 6.2 (PCPPs). Let V, r{n), q{n), l{n), and s{n), be as in Definition 16. !( and let 

/9 : N — ?• (0, 1]. We say that ^ is a PCPP system for CircuitSaT|o^i} with rejection ratio p if the 
following holds for every circuit if : {0, 1}' ^ {0, 1} of size n: 

• Completeness: For every satisfying assignment x for if there exists a proof string tTx G 
{0, lY such that 



Pr 

1,4' 



1 



where / and ip are the (random) output of V {(p). 

Soundness: For every x G {0, 1}* that is e-far from a satisfying assignment to ip and every 
proof string vr € {0, 1}^ the following holds: 



Pr 



ip ((xo7r)|^^ = 



>p-e 



The starting point for our construction of a dPCP is the fact that NP has PCPPs with reasonable 
parameters: 

Theorem 6.3 ( |BGHSV06t IDR06] ). CircuitSaT{o,i} has a PCPP system with randomness com- 
plexity 0(logn), query complexity 0(1), proof length poly(n), decision complexity 0(1), and rejec- 
tion ratio 

Remark 6.4. The PCPPs described in Definition 16.21 are known in the literature as "strong 
PCPPs". An alternative definition of PCPPs, known as "weak PCPPs", requires only that ev- 
ery assignment x G {0, 1} that is very far from a satisfying assignment will be rejected with high 
probability, while other non-satisfying assignments may be accepted with probability 1. 



6.2 The definition of decodable PCPs 

Decodable PCPs (dPCPs) were defined in the work of |DH09j in order to overcome certain limita- 
tions of PCPP^. As mentioned above, the definition of jDH09] is only useful if the soundness error 
is indeed very low. Below, we recall the definition of [DH09j and suggest an alternative definition 
for the case where the soundness error is high. This alternative definition will be useful later in the 
construction of decodable PCPs with low soundness error. 

^In particular, using arguments in the spirit of |BHLM09] . it is easy to prove that a PCPP that has low soundness 
error must make at least three queries. Hence, PCPPs can not be used to construct two-query PCPs with low 
soundness error. 



29 



6.2.1 Recalling the definition of [ DH09j 



Intuitively, a PCP decoder for CircuitSat is an oracle machine D that is given as input a circuit 
and is also given oracle access to a "proof" vr that is supposed to be the encoding of some 
satisfying assignment x to The PCP decoder D is required to decode a uniformly distributed 
coordinate k of the assignment x by making only few queries to vr. It could also be the case that 
the proof vr is too corrupted for the decoding to be possible, and in this case D is allowed to output 
a special failure symbol ±. Thus, we say that D has made an error only if it outputs a symbol 
other than and _L. We refer to the probability of the latter event as the "decoding error of D", 
and would like it to be minimal. 

It turns out that if we wish the decoding error of D to be very small, we need to relax the 
foregoing definition, and allow the PCP decoder D to perform "list decoding". That is, instead of 
requiring that there would be a single assignment x that is decoded by -D, we only require that 
there exists a short list of assignments x^ , . . . ,x^ such that the decoder outputs either _L or one of 
the symbols x\, . . . ,x^ with very high probability. Of course, this is meaningless if the assignments 
are binary strings, and therefore we extend the definition of CircuitSat to circuits whose inputs 
are symbols from some large alphabet T. 

We turn to give the formal definitions of (list-)decodable PCPs. As in the case of PCPPs, 
instead of letting the decoder make the queries and process the answers directly, we require the 
decoder to output the queries and a circuit ^ that given the answers to the queries outputs the 
decoded value. 

Notation 6.5. Let E and T be finite alphabets, and let f ^ S" be a function. We say that a 
circuit C computes / if it takes as input a binary string of length k ■ [log |r|] and outputs a binary 
string of length n ■ [log|S|] that represent the input in and the output in F" in the natural 
way. We will usually omit the function / and simply refer to the circuit C : P'^ — )• S". We will also 
view the circuit C as taking as input k symbols in P and outputs n symbols in S. Given a circuit 
: P* — > {0, 1}, an assignment x G P* for f is said to satisfy ip if and otherwise it is said to 

be unsatisfying. 

Definition 6.6 (PCP decoders, similar to |DH09t Definition 3.1]). Let r,q, s,£ : N ^ N, and let 
P, S be functions that map each n G N to some finite alphabet. A PCP decoder for CiRCUiTSATr 
over proof alphabet S is a probabilistic polynomial-time algorithm D that for every n G N acts as 
follows. Let P = P(n), S = i = i{n). When given as input an input circuit : P* — )• {0, 1} 

of size n and an index k G [t], the PCP decoder D tosses r(n) coins and generates 

1. A sequence of queries / = (ii, . . . , in [£] (where the queries are viewed as coordinates of 
a proof string in P^). 

2. A circuit ip : S''^") — )• P U {_L} of size at most s(n). 

We shall refer to the functions r(n), q{n), i{n), and s(n) as the randomness complexity, query 
complexity, proof length, and decoding complexity respectively. Without loss of generality we have 
£(n) =2'^(") •g(n) ■ t. 

Definition 6.7 (List Decodable PCPs, similar to |DH09[ Definition 3.2]). Let D, P, S, and i be 
as in Definition 16.61 and L : N — ;> N and e : N — ;> [0, 1] . We say that a PCP decoder D with the 
foregoing parameters is a (list) decodable PCP system for CiRCUiTSATr (abbreviated IdPCP) with 
list size L = L{n), soundness error e = e{n) if the following holds for every circuit : P* — {0, 1} 
of size n: 
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• Completeness: For every x € F* such that <f{x) = 1 there exists a proof strmg -Kx € 5]^ such 
that 

Pr, {t^x\i) =Xk\=l 
where k is uniformly distributed in [t] and / and tp are the (random) output of D {ip, k). 

• Soundness: For every proof string vr € S^, there exist a (possibly empty) list of satisfying 
assignments x^, . . . G F* for ip such that 

where k, I, ip are as before. 
6.2.2 Unique-decodable PCPs 

We turn to discuss our suggested definition for dPCPs for the case of high soundness error. If 
the soundness error is high, then we can actually require the PCP decoder to decode a unique 
assignment, instead of decoding a list of assignments. Thus, we refer to dPCPs with high soundness 
error as "unique decodable PCPs" (udPCPs). 

The straightforward definition for udPCPs would be to take the foregoing definition of IdPCPs, 
and set e to a large value and L to be 1. However, this definition turns out to be useless for our 
purposes. To see why, recall that our ultimate goal is to construct dPCPs with low error by first 
constructing dPCPs with high error and then decreasing their error using derandomized parallel 
repetition. However, if we define udPCPs using the above straightforward definition, then it is not 
even clear that sequential repetition decreases their erroiH. 

We therefore use the following alternative definition for udPCP. We now require that if the 
proof IT is such that the PCP decoder D errs with high probability, then D detects it with a related 
probability. In other words, we require that the probability that D outputs _L is related to the 
probability that D errs. Observe that such PCP decoders can indeed be improved by sequential 
repetition: If the proof vr is errorneous and we invoke the PCP decoder D many times, then the 
probability that D detects the error and outputs _L improves. Below we give the formal definition. 

Definition 6.8. Let D, F, S, and i be as in Definition 16.61 Let (/? : F* ^ {0, 1} be a circuit of size 
n, let X be an assignment to (f, and let vr € S^^"') be a proof for D. We define the decoding error of 
D on IT with respect to the probability 

Pr [i; (vr,,) 

where k, I, tp are as in Definition 16.71 We define the decoding error of D on it as the minimal 
decoding error of D on vr with respect to an assignment x' for ip, over all possible assignments x' 
to if. 

Definition 6.9 (Unique Decodable PCPs). Let D, F, S, and i be as in Definition 16.61 l^t p : 
N [0, 1]. We say that the PCP decoder D is a (unique) decodable PCP system for CiRCUiTSATr 
(abbreviated udPCP) with rejection ratio p if for every circuit (/9 : F* ^ {0, 1} of size n the PCP 
decoder D satisfies the completeness requirement of Definition 16.71 and furthermore satisfies the 
following requirement: 

■^The problem in performing sequential repetition for such definition of udPCPs is that we must invoke the PCP 
decoder on a uniformly distributed and independent index k in each invocation, and it is not clear how to use 
invocations for different indices k in order to decrease the error. 
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• Soundness: For every proof string vr € S , if D has decoding error e on vr then 

Pr U (tti/) = -L1 > p(n) ■ e 

where k, I, ip are as in Definition 16. 7i 

Remark 6.10. We could have also defined the decoding error of D on vr with respect to x as the 
probability Pr^.j ,^ {t^\i) ^ x^] . This definition may be more natural, but it is more convinient 
to work with the current definition. 

Remark 6.11. Note that the soundness requirement of in our definition of udPCPs is similar to 
the soundness requirement of PCPPs, and in particular to definition of soundness of strong PCPPs 
(see Remark [6. 4|) . We could also use a definition that is analogous to the definition of a weak PCPP. 
Specifically, we could have required only that when the decoding error is very large, the decoder 
rejects with high probability. However, our definition is stronger, and since we can satisfy it, we 
prefer to work with it. It is also more convenient to work with this definition throughout this work. 

We next argue that every PCPP implies a udPCP. 

Proposition 6.12. Let V he a PCPP system for CircuitSaT|o^i} with randomness complexity 
r{n), query complexity q{n), proof length i{n), decision complexity s{n), and rejection ratio p{n). 
Then, for every u : N — )■ N there exists a udPCP for CiRCUiTSAT|p ^u{n) with proof alphabet 
{0, 1}, randomness complexity r{n), query complexity q{n) + u{n), proof length n + i{n), decoding 
complexity s{n) + O (u(n)), and rejection ratio p{n)/u{n). 

Proof Let n : N — > N and denote u = u{n). For every circuit (p : ({0, 1}")* ^ {0, 1} of size n and 
satisfying assignment x for ip, we define the corresponding proof string for D to be x o Tr^; , where 
TTx is the proof string of V for x when x is treated as a binary string. 

Fix a circuit if : ({0,1}")* {0,1} and k G [t], and let x' G {0,1}"'*, vr G {0,1}^ On input 
((/3, k) and oracle access to a proof x' o vr, the decoder D first emulates the verifier V on (p with 
oracle access to x' o tt^. If V rejects, then D outputs ±. Otherwise, D queries the coordinates 

u ■ {k — 1) + 1, . . . ,u ■ k 

of x and outputs the tuple of answers as the symbol in {0, 1}" that it is ought to decode. 

It should be clear that D satisfies the completeness requirement, and has the correct randomness 
complexity, query complexity, proof length, and decoding complexity. 

It remains to analyze the rejection ratio of D. Let vr' be a proof string for D and assume that 
vr' = X o vr where x G {0, 1}"'* and vr G {0, 1}^. Let xq be the satisfying assignment of ip that is 
nearest to x when viewed as a binary string. Let £ be the relative distance between x and xq when 
viewed as strings over the alphabet {0, 1}". Cleary, the decoding error of -D on x o vr with respect 
to Xq is e, and is an upper bound on the decoding error of D. Furthermore, the relative distance 
between x and xq as binary strings is at least e/u. Thus, the emulation of V rejects x o vr with 
probability at least p{n) ■ e/u, and this is also the rejection probability of D, as required. ■ 

Remark 6.13. One could also prove Proposition 16.12] without a loss of a factor of u in the rejection 
ratio p using error correcting codes. 

Remark 6.14. It is not hard to see that the converse of Proposition 16.12] also holds. Namely, given 
a udPCP it is easy to construct from it a PCPP. 
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Remark 6.15. Our definition of udPCPs (Definition I6.9P bears some similarities to the notion of 
relaxed locally decodable codes jBGHSVOG], which are also constructed using PCPPs. However, 
the notions are fundamentally different. The most important difference between the notions is that 
while the decoder of a relaxed LDC should decode any possible message, the decoder of a udPCP is 
required to decode only satisfying assignments of a given circuit. This makes udPCPs signifcantly 
more powerful, and in fact makes them equivalent to PCPPs. A secondary difference is that when 
a udPCP is given oracle access to a corrupted oracle then it can output _L with any probability, 
while a relaxed LDC is required to output Xk (instead of _L) with some given probability. 

6.3 Decoding graphs 

6.3.1 The definition of decoding graphs 

Recall that in the first part of the paper, we often found it more convenient to work with constraint 
graphs instead of working with PCPs. We now define the notion of "decoding graphs" , which will 
serve as the graph analogue of decoding PCPs just as constraint graphs serve as the graph analogue 
of PCPs. 

Definition 6.16 (Decoding graphs). A (directed) decoding graph is a directed graph G = {V,E) 
that is augmented with the following objects: 

1. A circuit (p : {0, 1}, to which we refer as the input circuit. Here T denotes some finite 
alphabet. 

2. A finite alphabet S, to which we refer as the alphabet of G. 

3. For each edge e G -E, an index ke G [t], and a circuit -^e : 5] x E ^ P U {-L}. We say that e is 
associated with kg and '0e- For k £ [t], we denote by Ek the set of edges associated with k. 

The size of G is the number of edges of G. We say that G has decoding complexity s if all the 
circuits are of size at most s. It is required that G satisfies the following property: 

• Completeness: For every satisfying assignment a; € F* to (p, there exists an assignment 
■Kx ■ V ^ to G such that the following holds. For every edge {u, v) that is associated with 
an index k = k(u,v) and a circuit ip = iIj(u,v)i it holds that il) {■k{u), Tr{v)) = Xk- 

Notation 6.17. We will use the following terminology regarding constraint graphs: Let G = (V, E) 
be a decoding graph with input circuit (/9 : F* — )• {0, 1} alphabet S. 

1. Let {u,v) G E and V = '^{u,v) be and edge its associated circuit, and let vr : 1/ ^ S be an 
assignment to G. If ifj outputs _L on input (7r(n), 7r(t;)) then we say that {u,v) rejects n (or 
that TT violates {u,v)), and otherwise we say that {u,v) accepts vr (or that vr satisfies {u,v)). 

2. Let (n, u), ip, and vr be as before, let k = k(^u,v) be the index associated with {u,v), and let 
X be an assignment to tp. We say that (n, fails to decode x if tp {■7T{u),7r{v)) ^ 

When X is clear from the context we will omit it, and we will also say that (u, v) errs, or that 
{u,v) decodes correctly (if {u,v) does not err). Note that outputting _L is not considered to 
be failure. 

3. We say that G has the projection property if for every circuit ip(^u,v) bas an associated function 
f{u,v) : S ^ S such that V{n,i,) {a, 6) / _L if and only if (a) = b. 
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4. We refer to the quantity log (max;jg[^] \Ek\) as the randomness complexity of G, since it upper 
bounds the number of bits required to choose a uniformly distributed edge that is associated 
with a particular index. 

We turn to define soundness properties of decoding graphs. As in the case of decodable PCPs, 
we have two definitions, one for the case of high soundness error (unique decoding) and one for the 
case of low soundness error (list decoding) . 

Definition 6.18. Let G = {V,E), S, F, if be as before, and let vr : y — )• S be an assignment to G. 

• Unique decoding soundness: For every satisfying assignment x € T* to ip, we define the 
decoding error of G on tt with respect to x as the probability 

Pr ) (7r(u) ,7r(w)) ^ {xfc,-L}] 

where k is uniformly distributed in [t] and {u,v) is uniformly distributed in E^. Note that 
the edge (u, v) is chosen according to the decoding distribution of G. 

We define the decoding error of G on n as the minimal decoding error of G on tt with respect 
to any satisfying assignment of (/?. Now, we say that G has rejection ratio p if for every 
assignment vr to G, if G has decoding error e on vr then it holds that 

kG[t],(u,v)€Ek L V • 

where k and {u,v) are chosen as before. 

• List decoding soundness: We say that G is list-decoding with list size L and soundness 
error e if for every assignment vr to G there exists a (possibly empty) list of satisfying assign- 
ments x^, . . . ,x^ S for (/? such that 

, ^w^^ r. [^{u,v){T^{u)^T^{'"))i{xl,...,X^,l.]]<e 

fce[t],(M,-!;)eEfc 

where k and (n, v) are chosen as before 

The following proposition gives the correspondence between decoding PCPs and decoding 
graphs, in analogy to the correspondence between PCPs and constraint graphs. 

Proposition 6.19. Let r, s,i, p,T,Y, be as in Definition \ 6.9l The following two statements are 
equivalent: 

• ClRCUixSATr has a udPCP with query complexity 1, randomness complexity r , decoding 
complexity s, proof length I, proof alphabet S, and rejection ratio p. 

• There exists a polynomial-time transformation that transforms a circuit (/9 : F* — t- {0, 1} of size 
n to a decoding graph G = {V,E) with i{n) vertices, randomness complexity r{n), decoding 
complexity s{n), proof alphabet S (re), and rejection ratio p{n). 

A similar equivalence holds for IdPCPs and list-decoding graphs. 
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6.3.2 Additional properties of decoding graphs 

Recall that when discussing constraint graphs, we were interested in the probability that a uniformly 
distributed edge of the graph is satisfied by a given assignment. As can be seen in Definition I6.18| 
when discussing decoding graphs we are interested in a different distribution over the edges, defined 
below. 

Definition 6.20. The decoding distribution T>g of a decoding graph G = (V, E) is the distribution 
over the edges of G that is corresponds to the following way for picking a random edge of G: Choose 
k € [t] uniformly at random, and then choose an edge uniformly at random from Ej.. 

It is usually inconvenient to analyze the decoding distribution of the graphs we work with. 
However, we will work only with graphs whose decoding distribution is similar to the uniform 
distribution over the edges. The following definition aims to capture this property, which allows us 
to analyze the uniform distribution instead of the decoding distribution. 

Definition 6.21. We say that a decoding graph G = (y,E) has smoothness 7 if its decoding 
distribution is 7-similar to the uniform distribution over E. 

The following proposition gives a comfortable way for calculating the smoothness of a decoding 
graph. Intuitively, observe that if all the sets £'fc are of the same size then the decoding distribution 
is identical to the uniform distribution. We now observe that if the sizes of the sets E^ are close to 
each other then the decoding distribution is similar t to the uniform distribution. 

Proposition 6.22 (Smoothness criterion). A decoding graph G with edge-set E has smoothness 7 
if and only if for every fc G \t], the number of edges that are associated with k is between 7 • ^ and 

1 \m 

Proof Observe that if there are mk edges associated with k € [t] then the probability for such an 
edge to be chosen under the decoding distribution is 7 • — while the corresponding probability 
under the uniform distribution is Now apply the definition of similarity of distributions. ■ 

We will often want our decoding graphs to be regular, or at least have bounded degree. The 
precise definition follows. 

Definition 6.23. We say that a decoding graph G has degree bound d G N if all the in-degress and 
all out-degrees of the vertices in G are bounded by d. We say that it is d-regular if every vertex 
has exactly d incoming edges and exactly d outgoing edges. 

6.3.3 General udPCPs and decoding graphs 

Proposition 16.191 gave us only a correspondence between decoding graphs and udPCPs that makes 
exactly two queries. The next proposition shows that in fact any udPCP, even if it uses more 
than two queries, gives rise to a procedure that transforms circuits to decoding graphs with related 
parameters and unique decoding soundness. A nice property of this procedure is that it generates 
decoding graphs that are regular and have smoothness 1, which will be useful later in this work. 

Proposition 6.24. Let T, S, r(n), q{n), l{n), s{n), and p{n) be as in Definition \ 6.9l and let 
ho and do be the constants from Fact \2.17\ If there exists a udPCP D for CiRCUiTSATr with 
the foregoing parameters, then there exists a polynomial time procedure that acts as follows. When 
given a circuit : F* — )• {0, 1} of size n, the procedure outputs a corresponding vertex- decoding graph 
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G = {y,E) with randomness complexity r{n) + log (do • q{n)), alphabet T,'^('^\ decoding complexity 
s{n) + poly log |S(n)[, and rejection ratio Q (^p{n)/ (g(n))^^ . Furthermore, G is {q{n) ■ dQ)-regular, 
and has t ■ 2^'^"'^ vertices and smoothness 1. 

Proof sketch The proof is a variant of a well known technique for reducing the query complexity 
of a PCP verifier to 2. The graph G is constructed roughly as follows: The graph G has a vertex 
for every possible invocation of the decoder D. Each such vertex v is expected to be labeled with 
the answers that D receives to its queries on the corresponding invocation, and the edges that are 
connected to v check that those answers are not rejected by D. The edges of G also verify that the 
labels of the different vertices are consistent with each other, and in order to save in the number 
of edges we choose the consistency checks according to an expander. The full details of the proof 
are provided in Appendix iDl 

Observe that since a vertex should be labeled with all the answers that D gets to its queries on 
this particular invocation, we can use those labels to perform decoding. In particular, given that 
an edge {u, v) accepts, the value that it decodes can be decided based only on the label of u. This 
property will be useful in Section [7] (see Definition 17.11 for details). ■ 



6.4 Proof of Theorem 11.41 

In this section we state and prove Theorem 11.41 

Theorem I\1A\ dPCP, restated formally). For every function T that maps natural numbers to 
finite alphabets such that |r(n)| < 2P°'y^°s" the following holds. There exists an IdPCP D for 
Circuits ATrwit/i query complexity 2, proof alphabet 2'^°^'^'^°^^, randomness complexity O(logn), 
soundness error 1/ log^^"*^^ n, and list size poly log n. Furthermore, D has the projection property 
(see Notation \6ll\ Item\^. 



We prove this theorem analogously to the proof of Theorem II. 1[ Our starting point is a known 
construction of a PCPP, stated here as Theorem 16.31 which is then reduced to a transformation 
mapping circuits to decoding graphs. We then have two main steps. The first is to equip the 
decoding graphs with linear structure, as formulated in Lemma 16.251 The second step is to reduce 
the error by derandomized parallel repetition, as stated in Lemma I6.26[ Theorem 11.11 follows by 
combining the two lemmas which we state next. 

Lemma 6.25 (udPCP with Linear Structure). There exists a polynomial time procedure that sat- 
isfies the following requirements: 

• Input: 

— A decoding graph G of size n for input circuit (/? : — > {0, 1} with alphabet E, rejection 
ratio p, decoding complexity s, and smoothness 7. 

— A finite field ¥ of size q such that q > A - d^, where do is the constant from Fact 2.11 . 



Output: A decoding graph G' = (F"^,£") for ip such that the following holds: 

— G' has a linear structure. 

— The size of G' is at most O {q ■ n/'j). 

— G' has alphabet . 

— G' has rejection ratio Q, [p/q^ ■ log^(n/7)) 
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— G' has decision complexity s + poly (log^ (n/7) , log [r[) 

— G' has smoothness Q{l/q). 

Lemma 6.26 (Derandomized Parallel Repetition for udPCPs). There exist a universal constant h 
and a polynomial time procedure that satisfy the following requirements: 

• Input: 

— A finite field ¥ of size q. 

— A decoding graph G = {F'^,E) of size n for input circuit : P* — t- {0, 1} with linear 
structure, alphabet S, rejection ratio p, decision complexity s, and smoothness 7. 

— The rejection ratio p of G. 

— A parameter do £ such that do < m/h"^ and p > h ■ do ■ q^'^'^^^/j. 

• Output: A decoding graph G' for ip such that the following holds: 

— G' has size n^^'^°\ 

— G' has alphabet 5]'?'^^'^''' . 

— G' is list-decoding with soundness error e'= h ■ dQ ■ q~'^o/h^^ ^^^^ j^j^^^ gj^^^ ^ <M ^O(do)_ 

— G' has the projection property. 

— G' has decoding complexity q'^^^o) . _|_ poly log |S|). 
We now turn to prove Theorem II. 4[ 

Proof Let F be a PCPP verifier for CircuitSat as in Theorem I6.3[ By Proposition 16.121 this 
implies a udPCP for CircuitSat with similar parameters. Next, by Proposition 16.241 we get a 
polynomial time transformation taking a circuit (/? : {0, 1}" — > {0, 1} into a vertex-decoding graph. 
The graph G has the following parameters. The randomness complexity is r{n) = O(logn), the 
decoding complexity, rejection ratio, and constant proof alphabet are constant, and the smoothness 
is 1. 

We choose q to be the least power of 2 that is at least log n, and set F to be the finite field of 
size q. We now invoke Lemma 16.251 on input G and F, and obtain a new vertex-decoding graph Gi 
with linear structure and parameters: 

• The size of Gi is at most 0{q ■ n). 

• Gi has alphabet size 2^('°g9(")). 

• Gi has rejection ratio pi'= [p/ q^ ■ logq(n)) 

• Gi has decision complexity poly(logg n) 



• Gi has smoothness 71 = O 




Finally, we set do to be an arbitrary constant such that pi > h ■ do ■ q^'^'-''^^ /ji . Note that this is 
indeed possible, since logg (l/pi) is a constant that depends only on p. Finally, we invoke Lemma[33] 
on input Gi, F, pi, and do, and denote by G' the output decoding graph. The transformation taking 
the initial input (p into G' (via intermediate steps G and Gi) is equivalent, by Proposition 16. 19] to 
a dPCP with the claimed parameters. ■ 
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6.5 Proof of the result of |MR08] . Theorem D 



Our Theorem 11.11 asserts the existence of a two query POP with soundness error 1/polylogn and 
alphabet size ISI = 2P°iyi°s". In this section we win sketch a proof of Theorem 11.21 in which 
the alphabet size jS| can be any value smaller than 2P°^y^°s" while maintaining the relation of 
e< l/poly(log|S|). 

Theorem. 11.21 restatedjFor any function e{n) > 1/polylogn the class NP has a two-query 
PCP verifier with perfect completeness, soundness error at most e over alphabet S of size at most 

< 2^/p°^>'('^). 

Our proof of Theorem 11.21 relies on the scheme of [DH09j who showed a generic way to compose 
a PCP with a dPCP, and then proved Theorem 11.21 bv repeating the composition step, assuming 
the existence of two building blocks: a PCP and a dPCP. We plug in our constructions of a PCP 
(Theorem I l.ip and of a dPCP (Theorem II. 4p into the composition scheme of |DH09) and obtain a 
new construction of the verifier of Theorem 11.21 that does not rely on low degree polynomials. 

Remark 6.27. An important feature of the theorem of j MROSj asserts that the verifier is randomness- 
efficient, i.e. it uses only (1 + o(l)) logn random bits rather than O(logn) random bits. Using the 
composition scheme of [DH09j . the outcome will be randomness efficient as long as the PCP verifier 
at the outermost level of composition is randomness-efficient. It does not, for example, depend on 
whether the dPCP is randomness-efficient. 

However, since our PCP verifier from Theorem 11.11 is not randomness-efficient, we can only 
get this additional feature by relying at the outermost level on a PCP verifier as in |MR08] . The 
dPCP can still be based on our Theorem 11.41 Alternatively, if we also base the outermost PCP on 
theorem II. II we get a polynomial-size construction, but not a "randomness-efficient" one. It is also 
conceivable that the construction of Theorem 11.11 can be improved to yield a randomness-efficient 
PCP, and we leave this for future work. 

In order to state the generic composition theorem of |DH09j let us first define the decision 
complexity of a PCP verifier. Roughly speaking, a PCP verifier has decision complexity s(n) if 
every constraint in the underlying constraint graph can be computed by a circuit of size at most 
s(njj. This definition is analogous to the definition of the decoding complexity of a PCP decoder. 
It is easy to see that the PCP verifier (from Theorem II. ip has decision complexity poly log n in 
the same way that the dPCP decoder (from Theorem II. 4p was shown to have decoding complexity 
poly logn. 

Theorem 6.28 (Paraphrasing |DH09| ). Let V and D be a PCP verifier and a PCP decoder as 
follows: 

1. Let V be a two-query PCP verifier for NP with perfect completeness and soundness error 
A(n). Assume further that the underlying constraint graphs have the projection property, 
such that the alphabet size is at most |S(n)|, and such that the constraint graph has decision 
complexity at most s{n). 

2. Let D be a two-query PCP decoder for CiRCUiTSATr for some r(n). Assume D has perfect 
completeness, soundness error 5{n), list size L[n), and alphabet size \(T{ri)\. 

If both V and D have the projection property then there is a PCP verifier V ® D with the following 
properties. V ® D invokes D on inputs of length at most s{n). V ® D has perfect completeness, 

''More precisely, the verifier should be able to compute this circuit based on its input and its randomness. 
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soundness error 0{5{s{n)) + L{s{n))A{n)) , alphabet size \a(s{n))\^"^-^^^^'^^"''^'^^^^'^^^'^'^\ andV®D has 
the projection property. 

The main gain from this theorem is that the alphabet size oi V ® D is much smaller than 
that of V. Let us see how this is useful. Suppose we take V, D from Theorems 11.11 and 11.41 We 
have S(n) < 2?°^^^°^^^^ s(^) = poly log n, and a{n) < 2P°'yi°e". Thus, cj(s(n)) = 2?°^^ 
Similarly L{s{n)) < poly log log n and 6{s{n)) = 1/poly loglogn. This results in alphabet size 
of 2P°iy'°si°g(") and soundness error of 1/poly loglogn. By composing this verifier again with D 
(yielding {V®D)®D) one can inductively obtain a PCP verifier with soundness error 1/poly log^*-* n 
for any i and corresponding alphabet size |S| = 2^^^°^^^"^^ To get any alphabet size |S| one must 
do careful padding and we do not go into these details. 

The composition theorem (Theorem I6.28P is stated here in the two-query terminology (rather 
than in the terminology of "robust" PCPs). Let us now give a brief outline of how to obtain this 
version from the version of jDH09| : 

1. From two-query to robust: Use Lemma 2.5 of |DH09j to deduce existence of a robust PCP 
rV and a robust dPCP rD with parameters related to V and D. In particular, the number 
of accepting views for rD is bounded by \a\. 

2. Composition: Apply Theorem 4.2 of |DH09] with parameter e = 5/L > \a\^^^\ Deduce a 
new robust PCP rV ®rD with parameters as follows. The soundness error is 6 + LA + 4:Le = 
0{6 + LA). The number of accepting views is at most (this follows from inspecting 
the proof, but not directly from the theorem statement). 

3. Back to two queries: Again use Lemma 2.5 to move back to a two query PCP. The new alpha- 
bet size is at most the number of accepting views of rV ®rD which is at most \a{s{n))\^^^ = 
\a\^^^^^ as claimed. 

7 Decodable PCPs with Linear Structure 

In this section we prove Lemma [6. 251 i-^-, that every decoding graph G can be embedded on a graph 
that has linear structure. The heart of the proof is very similar to the proof of the corresponding 
lemma for constraint graphs (Lemma 13. 2p with few adaptations to the setting of decoding graphs. 
Two important differences are the following: 

1. Recall that we prove Lemma 13.21 by embedding the constraint graph G on a de Bruijn graph 
VB, and that this is done by identifying the vertices of G with the vertices of VB. Further- 
more, recall that if VB has more vertices than G, then some of the vertices of VB are not 
identified with vertices of G, and thus we place only trivial constraints on those vertices. 
This construction does not work for decoding graphs. The reason is that in the setting of 
decoding graphs every edge needs to be able to decode some index k € [t]. Furthermore, 
every edge that fails to decode must contribute to the fraction of rejecting edges. Thus, we 
can not have many trivial edges. 

In order to resolve this issue, we prove a proposition that allows us to ensure that G has 
exactly the same number of vertices as in DB, see Proposition 17.41 below. 
We note that Item [1] is not caused by the fact we chose a strong definition of udPCP and not 
a weak one (see Remark 16. lip . Even if we used a weak definition of udPCP, requiring edges 
to reject only if the decoding error is above some threshold, we still could not use dummy 
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vertices and edges in the embedding, as this would cause the aforementioned threshold to be 
too large for our purposes. 

2. Recall that in the embedding of constraint graphs on de Bruijn graphs we used the expander- 
replacement technique (Lemma 14. 8p to make sure that the graph G has small degree. Since 
such a lemma was not proved for decoding graphs in previous works, we have to prove it on 
our own. This is done in Proposition 17.31 below. 

The rest of this section is organized as follows. In Section [7.11 we prove the aforementioned Propo- 
sitions [73] and [731 Then, in Section YT?2\ we prove Lemma [6.251 



7.1 Auxiliary propositions 

In this section we prove Propositions 17.31 and 17.41 mentioned above. In order to state those two 
propositions, we need to define a special kind of decoding graphs, called "vertex-decoding graphs". 
The reason is that we only know how to prove Proposition 17. 41 vertex-decoding graphs. Fortunately, 
we can convert any decoding graph to a vertex-decoding one using Proposition 17.31 

We move to define the notion of vertex-decoding graphs. Intuitively, a decoding graph is vertex- 
decoding if the value that an edge {u, v) decodes depends only on the labeling of u, while the labeling 
of V only affects on whether the edge accepts or rejects. The formal definition follows. 

Definition 7.1 (Vertex-decoding graphs). We say that a decoding graph G is a vertex- decoding 
graph if it has the following properties: 

1. For every edge (n, of G and its associated circuit ijj = there exists a function 
/ : E — >■ r that satisfies the following: For every assignment vr to the vertices of G for which 

(7r(u), 7r(f )) 7^ _L it holds that il) (7r(u), 7r(f )) = / (7r(n)). 

2. Every vertex has at least one outgoing edge. In other words, every vertex is capable of 
decoding at least one index G [t\. 

Remark 7.2. While the property of a graph being vertex-decoding is reminiscent of the projection 
property, there are two important differences. First, note that Item [1] in Definition 17.11 is weaker 
than the projection property, since it only requires that 7r(ii) determines the decoded value, and 
not necessarily tt{v). Second, note that Item [2] is not required by the projection property, and is 
actually violated by the known constructions of graphs that have the projection property. 

We turn to prove Propositions 17.31 and 17.41 We begin with Proposition 17.31 which says that 
we can always reduce the degree of decoding graphs while paying only a moderate cost in the 
parameters. As mentioned above, the proposition also transforms the decoding graph into a vertex- 
decoding graph. 



Proposition 7.3. Let do he the constant frova Fact \2.17[ and let d = 2do. There exists a polynomial 
time procedure that acts as follows: 



Input: A decoding graph G of size n for input circuit (/? : F* — >• {0, 1} with alphabet S, 
rejection ratio p, decoding complexity s, and smoothness 7. 

Output: A d-regular vertex- decoding graph G' of size at most d ■ n/j for input circuit ip, 
alphabet , rejection ratio ^{p), decoding complexity s -|- poly log | S | , and smoothness 1. 
Furthermore, G' has at most n/7 vertices. 
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Proof sketch We apply the same construction as in the proof of Proposition 16.241 Let ip : 
r* — {0, 1} be the input circuit of G. The key observation is that G corresponds to a decoder 
D that acts on ip such that D has query complexity 2, randomness complexity log {n/t -7), proof 
alphabet S, rejection ratio p, and decoding complexity s. The reason for the foregoing randomness 
complexity is that by the smoothness of G and by the smoothness criterion of Proposition 16.221 it 
holds that for every k G [t] there are at most n/t-^ edges that are associated with fc, and therefore 
choosing a uniformly distributed edge that is associated with G requires log {n/ (t -7)) uniformly 
distributed bits. Now, by applying the construction of the proof of Proposition 16.24] to the decoder 
D, we obtain a graph G' that satisfies the requirements. The fact that G' is vertex-decoding can 
be observed by examining the construction of Proposition 16.241 (see also the second paragraph in 
the above proof sketch of Proposition 16.241) . ■ 

We next prove Proposition 17.41 which says that we can increases the number of vertices of a 
vertex-decoding graph to any size we wish, while paying only a small cost in the parameters. This 
proposition will be used to ensure that the number of vertices of a decoding graph G is equal to 
the number of vertices of the de Bruijn graph on which we want to embed G. 

Proposition 7.4. There exists a polynomial time procedure that acts as follows: 

• Input: 

— A vertex- decoding graph G of size n for input circuit ip : ^ {0, 1} with i vertices, 
alphabet T,, rejection ratio p, decoding complexity s, degree hound d, and smoothness 7. 

— A number E N such that I' > I (given in unary). 

• Output: Let c '== j and let do and ho be the constants from Fact \2.1'7[ The procedure 
outputs a vertex-decoding graph G' of size at most 2 ■ (c -\- 1) ■ do ■ n for input circuit p 
that has exactly i' vertices and also has alphabet S, output size s + poly log rejection 
ratio r2 (7^ • p/d"^^, degree bound 2 ■ do ■ d, and smoothness ^ • 7. 

Furthermore, if G is d-regular then G' is (2 • do • d) -regular and has rejection ratio Q, (7^ • p) . 

Proof sketch The basic idea of the proof is as follows. Given the graph G, we construct the graph 
G' by replacing each vertex v oi G with multiple copies of v, such that the total number of vertices 
becomes i' as required. Each copy of v will be connected to the same edges as the original v. An 
assignment to G' will be required to assign the same value to all the copies of v: Clearly, if an 
assignment tt' to G' assigns the same value to the copies of each vertex v of G, then in a way vr' 
"behaves" like an assignment to G, and we can use the soundness of G to establish the soundness 
of G' with respect to vr'. In order to verify that the copies of a vertex v are assigned the same 
value, we will put equality constraints between the copies of v. In order to save edges, the equality 
constraints are placed according to the edges of an expander, and the analysis goes exactly as in 
the proof of Proposition 16.241 We use the fact that G is vertex decoding in order to allow the 
equality constraints to decode values even though they can use only the labeling of a single vertex 
of G. The rest of this proof consists of the technical details of this construction, and is provided in 
Appendix [El ■ 

7.2 Embedding decoding graphs on de Bruijn graphs 

In this section we prove the following proposition, which implies Lemma 16.251 and is analogous to 
Proposition 14. 4[ The proof follows the proof of Proposition 14.41 with the few adaptations to the 
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setting of decoding graphs. For inutition and a high-level explanation of the proof, we refer the 
reader to Section H] and in particular to Section 14.21 



Proposition 7.5. Let he the constant of Fact 2.11. There exists a polynomial time procedure 
that satisfies the following requirements: 

• Input: 

— A decoding graph G of size n for an input circuit ip : {0, 1} with alphabet T,, 
rejection ratio p, decoding complexity s, and smoothness 7. 

— A finite alphabet A such that [A| > 4 • dg. 

— A natural number m such that |A|™ > 2 - do ■ n/^. 

• Output: A decoding graph G' for (p such that the following holds: 

— The underlying graph of G' is the de Bruijn graph VB^^m- 

— The size of G' is jAp^^ 

— G' has alphabet . 

— G' has rejection ratio Q. ^p/ [Ap • . 

— G' has smoothness at least 7' =^ Q. (^jxy) • 

— G' has decision complexity s + poly (m, log 

Let G, A, and m be as in Proposition 17.51 and let (/9 : F* — )• {0, 1} be the input circuit of G. 
On input G, A, and m, the procedure acts as follows. The procedure first constructs a vertex- 
decoding graph Gi by applying to G the procedure of Proposition 17.31 and then applying to the 
resulting graph the procedure of Proposition 17.41 with I' = \K\^ . It can be verified that Gi is a 

vertex-decoding graph for input circuit ip with exactly |A|™ vertices, alphabet Si *== Y? , rejection 
ratio pi = (p), decoding complexity s + poly log and smoothness at least i. Furthermore, Gi 
is d-regular for d = 4 • cZq < |A|, and is of size d ■ |A|™. 

Then, the procedure identifies the vertices of Gi with the vertices of T)B = T>B\^m, partitions 
the the edges of Gi to d matchings pi, . . . and views those matchings as permutations on the 
vertices of VB. We apply Fact 14.51 to each permutation /ij resulting in a set of paths Vi of length 
/ =^ 2m. Let V = \jVi. 

Next, the procedure constructs G' in the following way. The alphabet of G' is set to be Ti^'^, 

viewed as {^i}'^- If <t € {^i)'^, and a = (cti, . . . ,0"^), we denote by aij the element (c^j ^ ^i- It 
remains to describe how to associate each edge e of G' with an index kg € [k] and with a circuit 
V'e- To this end, we first describe in which cases a circuit ip^ accepts, and then describe how the 
index k^ is chosen and what is the output of ipe when it accepts. 



The conditions in which accepts Fix an edge e' = {u,v) of G' , and let ipe be the circuit 
associated with e. The circuit ipe accepts in exactly the same cases in which the constraint that 
corresponds to e in the proof of Proposition 14.41 accepts. That is, the circuit V'e accepts if and only 
if all of the following conditions hold: 

1. For every i £ [d], the values ( vr' (u)j ; , n' {u)^ ^ j satisfy the edge [fi~^{u),u) of G. 
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2. It holds that vr' (n)-^ = . . . = vr' (u)^ ^ and that n' (v)-^ ^ = . . . = tt' (v)^ ^. 

3. For every i S [d] and j G [/ — 1] such that u and v are the j-th and (j + l)-th vertices of a 
path in p £ Vi respectively, it holds that vr' ('u)j j 7^ vr' (t')j 

4. Same as Condition [3l but when v is the j-th vertex of p and u is its (j + l)-th vertex. 

The choice of fcg and the output of ipe Fix a vertex u of G'. We describe the way we assign 
indices to the outgoing edges of u, and the output of the circuits ipe- We begin by associating 
the each of the |Aj outgoing edges of u in G' with one of the d outgoing edges of u in Gi. This 
association is done in a "balanced" way - that is, each outgoing edge of u in Gi is associated with 
either [|A| /d\ or [|A[ /d] edges of u in G' . 

Now, let e' be an outgoing edge of u in G', and suppose that it is associated with an outgoing 
edge ei of u in Gi, and that ei belongs to the matching /ij. Let kg^ and ipei be the index and circuit 
associated with ei. Recall that since Gi is vertex-decoding, there exists a function /g^ : Si ^ F 
such that whenever ip^-^ (o, &) 7^ -L it holds that ip^-^ {cL,b) = fe^{a). We associate e' with the index 
feei) and with the circuit "^e' that is defined for every a', h' € (S^)"' for which -^g' (a, ^) 7^ -L by 

i^,, (a',6')=/e, ((a')^_^) 
Note that ■i/'e' is indeed well defined, since the cases in which il^^,! outputs _L were defined above. 

The parameters of G' The size and alphabet of G' are immediate, and the completeness of 
G' can be established in the same way as in Proposition 14. 4[ It can also be verified that G' has 
smoothness at least 7' = using the smoothness criterion (Proposition I6.22p and a straightfor- 
ward calculation. 

It remains to analyze the rejection ratio of G' . Let vr' be an assignment to G' that minimizes the 
ratio between the probability that a random edge of G' rejects vr' (under the decoding distribution) 
to the decoding error of G' on vr'. As in the proof of Proposition H31 we may assume that for every 
vertex u of T>B it holds that vr' (u)-^ ^ = . . . = it' (u)^ ^, since otherwise we may modify vr' to such 
an assignment that satisfies this property without increasing the rejection probability or decreasing 
the decoding error. Let vri be the assignment to Gi defined by vri(ti) = ^'{u)^-^. Let e be the 
decoding error of Gi on vri, and let x be the assignment to (p that achieves this decoding error. Let 
e' be the decoding error of G' on vr' with respect to x. We show that the rejection probability of 
G' on tt' is at least (7' • pi ■ e' / |A| • m), and this will yield the required rejection ratio. 

Observe that by the smoothness of Gi (resp. G'), the fraction of edges of Gi (resp. G') that 

fail to decode x on vri (resp. vr') is at least 80*= ^ ■ e (resp. e'g = 7' • e'). Furthermore, the fraction 
of edges of Gi that reject vri is at least pi ■ Eq. This implies, using the same argument as in the 
proof of Proposition 14.41 that the fraction of edges of G' that reject vr' is at least Q, {pi ■ Eq/ |A| ■ m). 

We finish the proof by relating e'q with sq. To this end, observe that for every edge e' = {u, v) of 
G' and its associated edge ei of Gi, the edge e' fails to decode x on vr' (i.e. Tpe' (vr' (n)) ^ {^k^,, J-}) 

only if ei fails to decode x on vri (i.e. ipei ("^i (■")) ^ Furthermore, each edge ei of 

Gi corresponds to either [|A| /dj or [|A| /d] edges in G'. It can be verified by a straightforward 
calculation that this implies that s'q < 2 ■ eq. It now follows that the fraction of edges of G' that 
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reject vr' is at least 



{\A\-mJ - V|A|-my' 

\\A\-m J 

The required rejection ratio follows. 



8 Derandomized Parallel Repetition of Decoding Graphs with 
Linear Structure 

In this section we prove Lemma l6.26t restated below. 

Lemma (|6.26| restated). There exist a universal constant h and a polynomial time procedure that 
satisfy the following requirements: 

• Input: 

— A finite field F of size q. 

— A decoding graph G = (F^jS) of size n for input circuit ip : ^ {0, 1} with linear 
structure, alphabet S, rejection ratio p, decision complexity s, and smoothness 7. 

— The rejection ratio p of G. 

— A parameter do (zf^ such that do < m/h^ and p > h ■ do ■ q^'^'^^^/j. 

• Output: A decoding graph G' for ip such that the following holds: 

— G' has size n^^'^^\ 

— G' has alphabet S*"^""' . 

— G' is list-decoding with soundness error e'= h ■ do ■ q^'^^/h^^ j^j^^j. gj^^^ ^ 4^^ ^O(do)_ 

— G' has the projection property. 

— G' has decoding complexity q'-'^'^o) . _|_ poly log 

The proof follows the proof of the corresponding lemma for constraint graphs (Lemma 13. 3p . 
with the following modification: Recall that the proof of Lemma 13.31 described the graph G' by 
decribing a verification procedure (the E-test, Figure [2]). Moreover, recall that the E-test works 
by choosing a random subspace F of edges and verifying that the edges in F are satisfied by the 
assignment Il{F). 

In order to describe the graph G' of Lemma 16. 26^ we describe a decoding procedure (the E- 
decoder, see Figure H] below) . The E-decoder is constructed by changing the E-test as follows. 
Whenever the E-decoder is required to decode an index k G [t], the E-decoder chooses a random 
edge e that is associated with k, and then chooses the subspace F to be a random subspace that 
contains e. The E-decoder then checks, as before, that the edges in F are satisfied by the assignment 
n (F). If one of the edges in F is unsatisfied, then the E-decoder rejects. If all the edges in F are 
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satisfied, then the E-decoder decodes the index k by invoking the circuit associated with e on 
input n(F)|g. 

The intuition that underlies the construction of the E-decoder is as follows. Just as in the 
proof of Lemma 13.31 we argue that the E-decoder contains an implicit S-test, and therefore the 
assignment 11 needs to be roughly consistent with some assignment vr to G in order to be accepted. 
We now consider two cases: 

1. If G has high decoding error on vr, then by the soundness of G it holds that many of the edges 
of G reject vr. By the sampling property of F, there are many edges in F that reject vr, and 
therefore the E-decoder must reject with high probability. 

2. If G has low decoding error on vr, then due to the sampling property of F, only few of the 
edges in F err. In particular, since e is distributed like a random edge of F, it only errs with 
low probability. Thus, in this case the E-decoder decodes correctly with high probability. 

Thus, in both cases the soundness error of the E-decoder is small. 



8.1 The construction of G' and its parameters 

The decoding graph G' is constructed as follows. Let G = (F™,S) and be as in Lemma 16.261 
and let di = h ■ do where h is the universal constant from Lemma 16.261 to be chosen later. As in 
the proof of Lemma [3^31 the graph G' is bipartite, the right vertices of G' are the 2(io-subspaces of 
(the vertex-space of G), and the left vertices of G' are the 2(ii-subspaces of the edge space E 
of G. An assignment 11 to G' should label each 2(io-subspace A of with a function from A to 
S, and each 2(ii-subspace F oi E with a function that maps the endpoints of the edges in F to S. 
The edges of G' are constructed such that they simulate the action of the "E-decoder" described 
in Figure m 



1. Suppose that we are required to decode an index /c G [t\. Let e = {u, v) be a uniformly 
distributed edge of G that is associated with /c, and let be its associated circuit. 

2. Let Fl and Fr to be random di-subspaces of and let 

BL = Mt{FL). Bn^'^TigUiFR), F^^'Fl + Fr. 

Fl and Fr are chosen to be uniformly and independently distributed di-subspaces 
of E conditioned on e G F, dim(F) = 2di, dim(Si) = di, dim (B^j) = di, and 

BLnBR = {{)]. 

3. Let Al and Ar be uniformly distributed do-subspaces of Bl and Br respectively, and 
let 

A Al + Ar. 

4. If either 11 (F)|(-^^ / 11 ^^-j or the assignment 11 (F) is rejected by of the 
edges in F, output _L. 



5. Otherwise, output .V'e ( n (F)|„ , H (F),^ 



Figure 4: The E-decoder 
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The completeness, size, and alphabet size of G' is can be verified in the same way as it was 
done in the proof of Lemma 13.31 ^-iid so is the fact that G' has the projection property. It remains 
to analyze the soundness of G', which is done in the following section. 



8.2 The soundness of G' 

We turn to prove that G' is list-decoding with e = h ■ do ■ q~'^o/h^^ ^^^^ ^ist size L = Let 
n be an assignment to G'. That is, we prove that there exists a (possible empty) list of satisfying 
assignments x^,...,x^ € L* to the input circuit 99 such that when given as input a uniformly 
distributed index k £ [t], the probability that the output of the E-decoder is not in {x^, . . . , x^, _L} 
is at most e. 

Consider the distribution on the edges of G' that results from letting the edge e of the E- 
decoder be chosen according to the uniform distribution on the edges of G insead of the decoding 
distribution of G. We will refer to the above distribution as the G-uniform distribution of G'. It 
is straightforward to show that the G-uniform distribution and decoding distribution of G' are 7- 
similar, by applying Claim [2TT5] with Xi and X2 being the choices of e according the the G-uniform 
distribution and the decoding distribution, and Yi and Y2 being the G-uniform distribution and 
decoding distribution of G' respectively. In the following proof, all the probability expressions are 
not over the decoding distribution of G', but rather over the G-uniform distribution of G' . We will 
later use the similarity between the distributions to argue that G' has small soundness error with 
respect to its decoding distribution. 

Notation 8.1. We denote by T) the random variable that equals to the output of the E-decoder. 
As in the proof of Lemma 13.31 we denote by T the event in which the E-decoder accepts 11, so T 
is the event I? 7^ _L. Moreover, as in the proof of Lemma 13.31 for an assignment vr : — )• S, we 
denote by 11 {F) ~ vr the claim that for at least 1 — a fraction of the edges e of F it holds that 

a 

n (F) is consistent with vr on both the endpoints of e, and otherwise we denote 11 (F) 56 vr. 

Our proof proceeds in two steps. We first show that there exists a (possible empty) assignments 
vr^, . . . , TT^ : F™' — > S such that whenever the E-decoder accepts 11, it almost always does so while 
being roughly consistent with one of the assignments vr^, . . . ,7r^. We can then choose the assign- 
ments x^, . . . to be the assignments that minimize the decoding error of vr^, . . . , vr-^ respectively. 
Next, we show that whenever 11 is roughly consistent with vr*, the E-decoder either rejects 11 with 
high probability (if vr* has high decoding error) or decodes rr* successfully with high probability (if 
vr* has low decoding error). Thus, the overall probability that the E-decoder fails is small. 

The above strategy is made formal in the following three propositions. Let h' and c be the 
universal constants defined in Theorem 18.51 below, and let a'= h' ■ do ■ q-^-o/h' _ £q =^ g . = 
h-do- q-'^o^'^/S and let L = O (1/eg). 

Proposition 8.2. There exists a (possibly empty) list of assignments tt^,...,tt^ : F'" E such 
that 



Pr 



T and ^i G [L] s.t. U{F) vr* 



< 2-eo 



Proposition 8.3. For every assignment vr : F™ — > S on which G has decoding error at least £q/2L 

_ _ _ _ _ _ _ 4-Q 



it holds that Pr 



r and n (F) ^ tt 



< eo/L. 
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Proposition 8.4. For every assignment vr : F"* — > S on which G has decoding error less than 
£q/2L with respect to a satisfying assignment x to the input circuit ip it holds that 



Pr 



4-a 



Vi^Xk and Ii{F) ^ tt 



< £o/L 



where k is the index on which the E- decoder is invoked. 



Propositions 18.21 and 18.41 are proved in Sections 18.2.11 and 18.2.21 respectively. Proposition 18.31 can 
be proved in the same way as Proposition 15. 6^ by noting that due to the soundness of G, at least 
p ■ eQ/2L of the edges of G reject vr. 

We now prove that G' is (L, e)-list decoding using Propositions 18.21 18.31 and 18.41 Let tt^, . . . , vr^ 
be the assignments from Proposition 18.21 For each i G [L], let be the assignment to ip that 
attains the decoding error of vr*. The decoding error of G' on 11 under the G-uniform distribution 
of G' is as follows. 



VT[Vi{xl...,xt^]] < ^Pi 



< 



i=l 

+ Pr 

L 

i=l 

+ Pr 

L 



4-a 



Vi{xl...,xtL] andn(F)~"vr^ 
V i {xl,...,x^,l.] and e [L] s.t. H (F) vr^ 

Vi{xi,l.] andn(F)1^^^ 
r and jBi G [L] s.t. H (F) 1^ vr* 



i=l 
= 3 • £0 



(7) 



where Inequality [7] follows from Propositions 18.21 and 18.41 Finally, since the G- uniform distribution 
of G' and the decoding distribution of G' are 7-similar, it follows that the decoding error of G' on 
n under the decoding distribution of G' is at most ?> ■ Sq/^ = e, as required. 



8.2.1 Proof of Proposition [572] 

Recall that in order to analyze the soundness of the E-test in Proposition 15.51 we argued that the E- 
test contains an "implicit S-test", and then relied on a theorem regarding the S-test (Theorem l5.3p . 
The aforementioned theorem said that if the S-test accepts an assignment 11 with some probability, 
then there exists an assignment vr such that with some (smaller) probability, the S-test accepts 11 
while being consistent with the S-direct product of vr. This can be thought as a "unique decoding" 
theorem, that decodes vr from 11. 

In order to prove Proposition 18.21 for the E-decoder, we use a similar argument, but this time 
we use a "list decoding" theorem for the S-test. The following theorem says that there exists a 
short list of assignments vri, . . . , vr/,, such that it is almost always the case that if the S-test accepts 
n, it does so while being consistent with the S-direct product of one of the assignments vri, . . . , vri,. 

Theorem 8.5. There exist universal constants h',c (zf^ such that for every do E N, > /i' • do, 
andm > h'-di, the following holds: Let e > h' ■dQ-q~'^°/^' , a '= h' ■ do- q~'^'^^^' . LetU. be a (possibly 
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randomized) assignment to 2do-subspaces ofF"^ and to pairs of di- sub spaces of¥"^. Then, there 
exists a (possibly empty) list of L = 0{l/e'^) assignments vr^, 



S such that 



Pr 



U{Bi,B., 



2^|{Ai,A2) 



n(^)|(A„A2) and ^ie[L] s.i. n(i?i,i?2)S4B,,B,) 



< e 



Theorem 18.51 is proved in Section [H 

We turn to prove Proposition 18.21 based on Theorem 18.51 As in the proof of Proposition 15.51 
we begin by extending 11 to disjoint di-subspaces of in a randomized manner as follows: Given 
a pair of disjoint di-subspaces Bi and B2, we choose Fi and F2 to be uniformly distributed and 
disjoint di-subspaces of E such that left(-Fi) = Bi and right (F2) = B2, and set n(i?i,i?2) = 

Again as in the proof of Proposition 15.51 we observe that the probability that the E-decoder 
accepts equals to the probability that the S-test accepts the extended 11. The reason is that the 
subspaces Bl, Br, Al, Ar of the E-decoder are distributed like the subspaces Bi, B2, Ai, A2 of the 
S-test. By choosing h to be at least the constant h' we can invoke Theorem 18.51 and conclude that 
there there exists a list of L = O (l/e'^) assignments vr^, . . . ,7r^ : F™ S such that for subspaces 
Bi, B2, Ai, A2 as in the S-test it holds that 



Pr 



n(Si,S2)|(Ai,A.) = n(^)i(A,,A.) and ^ie[L] s.t. n(i?i,i?2)«4B„B,) 



< £0 



The latter inequality is equivalent to the following inequality: 



Pr 



n(F) 



iBL,BR) 



UiA) 



\iAi,A2) 



and ^i G [L] s.t. H ^ 7r[(^^^^^) 



which in turn implies the inequality 



Pr 



r and ^i G [L] s.t. H p. 4^^^^^ 



(8) 



In the rest of this section we show that this implies that 



Pr 



4-0 



r and ^i G [L] s.t. U (F) « tt 



< 2-eo 



To this end, we use Claim 15. 8| which was proved in Section 15.3.11 and is restated below. 



(9) 



4a 



Claim (j5.8l restated). For every fixed 2dQ-subspace Fq of E such that U (Fq) 96 vr, it holds that 



Pr 



_'^i^)\(BL,Bn) -^\(BL,Bn) 
Claim [STSl implies immediately the following corollary. 
Corollary 8.6. For every i G [L] it holds that 



F = Fn 



Pr 



4-a 



<1/ 



In order to prove Inequality [9l we first show that 



Pr 



r and fli G [L] s.t. H « 7r[(^^^^^) fli G [L] s.t. U{F) « vr' 



4 a 



> 



(10) 
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To show it, we prove an upper bound on the complement event, that is, we prove that 



Pr 



r and 3i G [L] s.t. Yi{F)^^j,^ j,^^ ^ ^Wb^) ^ W s-t. H (F) « vr' 



4-a 



< 



To see the latter inequality, observe that the right end side is upper bounded by 



4-a 



e W s.t. n(F) « vr- 



< EvK^ 

ie[L] 

= O ixlel ■ . ^2 



< - 



where the first inequality follows from Corollary [8?6l and the second inequality follows for sufficiently 
large choice of h. Now, it holds that 



Pr 



4-a 



r and G [L] s.t. U{F\^^^,,^^ « ^B^.s^) and G [L] s.t. H (F) « n 



(11) 



is upper bounded by 



Pr 



r and G [L] s.t. n(F)|(^^_^^) S ^f^^^^^ 



On the other hand, by writing the probability in (jlip in conditional form and applying Inequality 1 10^ 
we obtain that the probability in (llip is at least 



- • Pr 

2 



4-a 



r and G [L] s.t. U (F) ^ it' 
By combining the two last bounds, we obtain that 



Pr 



4-a 



r and G [L] s.t. U (F) w tt 



< 2-eo 



as required. 



8.2.2 Proof of Proposition [83] 

Fix an assignment tt : F™" ^ S on which G has decoding error less than eo/2L with respect to a 



satisfying assignment x of the input circuit ip. We prove that Pr 



4-a 



D ^Xk and H (F) vr 



< £o/L 



4-a 



Let us denote by f i the event in which 11 (F) ~ vr and by f2 the event in which F contains less 
than £o/3L fraction of edges on which G fails to decode x on vr. We will prove that 



Pr [V Xk and f i] = Pr 



4-a 



Xk and 11 (F) f« vr 



< £o/L 



It holds that 

Pr [V / Xk and £i] = Pr [2? / Xfc and fi and £^2] + Pr [i^icL, b) / Xfc and £1 and -i<52] 
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1. Choose two uniformly distributed di-subspaces Bi, B2 of F'". 

2. Choose two uniformly distributed do-subspaces Ai Q Bi, A2 Q B2. 

3. Accept if and only if n (Si, ,62 ) 1(^1,^2) = n(^i,A2). 

Figure 5: The P^-test 

We upper bound both terms on the right hand side. The second term is clearly upper bounded by 
Pr [^£2]- The latter probability can be shown to be at most O (L^/g^ '^^"^ • Eq + using 
the fact that F samples well the edges of G, and more specifically using an argument similar to the 
one used in the proof of Proposition 15.61 For sufficiently large choice of h, the latter expression is 
upper bounded by e/3L. 

We turn to upper bound the probability Pr [D ^ xj and £1 and £2]- This probability is upper 
bounded by the probability Pr [V / Xj\£i and £2]- Now, let Fq be any 2(ii-subspace of E such that 

n (Fq) « TTi and such that the fraction of edges of Fq that fail to decode x on vr is at most 2eo/3L. 
Let us consider the probability Pr [V ^ Xj\F = Fq]. Observe that conditioned on the choice F = Fq, 
the edge e chosen by the E-test is uniformly distributed among the edges of F. Observe that e fails 
to decode x only if one of the endpoints of e is inconsistent with vr or if e is one of the edges in F 
that fail to decode x on vr. The probability of the first case is at most 4 • a < Eq/SL (where the 
latter inequality holds for sufficiently large choice of h), and the probability of the second case is 
at most Eq/SL. It therefore holds that 

Pr [V / Xk and £1 and £2] <Pr[V^ Xj\F = Fq] < eo/3L + eo/3L < 2eo/3L 

All in all, it holds that Pr [V / Xk and £"1] is at most 2eo/3L + 3 ■ Eq/SL = eq/ L, as required. 

9 The Analysis of the SpeciaUzed Direct Product Test 

In this section we provide the analysis of the S-test and prove Theorems 15.31 and 18.51 which are 
used in Sections 15.3.11 and 18.2.11 The proof proceeds in two steps. First, in Section lOTTl we define 
and analyze an intermediate direct product test, which we call the P^-test. Then, in Section 19.21 
we reduce the analysis of the S-test to the P^-test. 

For the rest of this section, we let F be a finite field of size q and let do,di € N. 

9.1 The P2_test 

In this section we define and analyze the P^-test. Informally, the P^-test consists of two P-tests 
that are performed simultaneously. Details follow. 

Given two strings vri, 7r2 : F"^ S, we define their -direct product 11 (with respect to do, di G 
N) as follows: 11 assigns each pair of c?o-subspaces (^1,^2) the pair of functions {t^i\Ax-,'^2\A2)-' 
and assigns each pair of di-subspaces (Pi,P2) to the pair of functions {t^i\Bi-,t^2\B2)- We consider 
the task of testing whether a given assignment 11 is the P^-direct product of some pair of strings 
7ri,7r2 : F"^ S. That is, we are given an assignment 11 , and in order to check whether 11 is a 
P^-direct product, we invoke the P^-test, described in Figure [5l 

It is easy to see that if 11 is a P-^-direct product then the P'^-test always accepts. Again, it 
can be shown that if 11 is "far" from being a P'^-direct product, then the P^-test rejects with 
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high probabiHty, and that this holds even if 11 is a randomized assignment. Formally, we have the 
following result. 

Theorem 9.1. There exist universal constants h,c € N such that the following holds: Let e > 
h- do ■ q~'^o/h^ a'= h- do ■ q~'^o/h^ Assume that di > h - do, m > h ■ di. Suppose that an assignment 
n passes the P'^-test with probability at least e. Then, there exist two assignments tti and it2 to 
such that for uniformly distributed Bi, B2, A\, A2 as in the P'^-test it holds that 

Pr n(Si,52)|(^^_^2) = n(Ai,^2) and n(Ai,A2) « (7ri|^^,7r2|A2) and U{Bi, B2) ^ {tti\b„ 7^2132) 
is at least 0, (e^). 

In the rest of this section we prove Theorem 19. 11 We denote by V the event in which the P^-test 
accepts, that is, that 11 {Bi, i32)|(y^^ y^j) ~ ^ (^ij ^2)- The core of the proof is the following lemma: 

Lemma 9.2. There exist universal constants h',c' € N such that the following holds: Let e > 
h' -do- q-'^o/^' , a' h' ■ do ■ q-'^o/h' _ Assume that di > h' ■ do, m>h'-di. IfU passes the P'^-test 
with probability at least e then there exists an assignment 1^2 '■ F™ — )• T, such that 



Pr 



V and n(Ai, ^2)1^2 ^ ^2|A2 and (Si, ^2)152 ~ 7r2|B2 



and symmetrically, there exists a function tti : F™ — >■ E such that 



Pr 



V and 11(^1,^2)1^^ « vTii^^ and {Bi,B2)\b^^ tti\b^ 



> nie" ) 



We prove Lemma 19.21 in Section 19.1.11 We turn to derive Theorem 19.11 from Lemma [9T 

Proof of Theorem 19.11 The following proof is for the case where 11 is not randomized, but it can 
be easily extended to the case where 11 is randomized (see Remark 19.31 for details). We will choose 
h to be larger than the constant h' of Lemma 19.21 so we can apply this lemma. Let 7r2 : F™ —?■ T, 
be the assignment guaranteed by Lemma [9.21 and let 11' be an assignment that is obtained from 11 
as follows: 

a' 

1. For every pair (^1,^2) for which 11(^1,^2)1^2 ^ ^2|A2i set IT' (^1,^2) = 11(^1,^2). 

2. For every other pair (^1,^2), set U' {Ai,A2) = -L, where _L is some special value on which 
the test never accepts. 

3. Set the pairs (i?i,i?2) similarly. 

The probability e' that the assignment H' passes the P^-test is at least ^^{e^') by the definition of 
772- By choosing h to be sufficiently larger than the corresponding constants of Lemma 19.21 we can 
make sure that e' satisfies the requirements of Lemma [9. 2 1 Therefore, we can deduce by Lemma [9.21 
that there exists an assignment vri : F"* — > S such that 



Pr 



V and n' (^1,^2)1^, ^VTii^^ andn'(Si,B2)|ij, ^VTiiB^ 



We now choose c = (c') . Since the test never accepts when H' answers ±, we deduce that 



Pr 



V and n(^i,^2) ^ (vri|A,,7r2|A2) and U{Bi, B2) ^ {7riiBi,T^2\B2) 



Choosing h such that a > a' completes the proof. 
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Remark 9.3. If 11 is randomized, then the definition of 11' in the foregoing proof should be slightly 
changed to consider the internal randomness of 11. That is, we define 11' to be a randomized 
assignment, and obtain it from 11 as follows. For every pair (^1,^2) and every internal randomness 
u) of n, let us denote by (01,02) the output of 11 on {Ai,A2) and randomness u. We define the 

a' 

output of n' on {Ai,A2) and randomness 00 to be (01,02) if 02 w ^2|A2' define it to be _L 
otherwise. The definition for pairs (i?i,i?2) is again similar. 

9.1.1 The proof of Lemma [972] 

We prove Lemma 19.21 only for the assignment 112, and the conclusion tti can be proved analogously. 
The proof proceeds in three steps. First, we rely on Theorem 12.11 to find for each pair of Ai,Bi 
a direct product function that agrees (on average) with a good fraction of n(74i, ■) and n(i?i, •). 
Then, we show that for each Ai separately, the number of distinct such functions is bounded. 
Next, we show that there is a single function vr such that the probability that the test accepts and 
11(^1,^2)1^2 ~ '^\M non-negligible (Apriory there could have been a different vr for each ^1). 
Finally, we extend the latter result for di-subspaces Bi, B2. Let hi be the universal constant whose 
existence is guaranteed in Theorem 12.11 and let ai be the corresponding value from Theorem 12. 1[ 



Step 1. Consider the bipartite graph corresponding to the P-test, that is, the graph whose left 
vertices are do-subspaces and whose right vertices are di-subspaces, and such that a do-subspace 
Ai is connected to a di-subspace Bi by an edge if and only \i Ai <^ Bi. . We label an edge (^1, Bi) 
by vr : F" ^ S if 



Pr 

A2,B2 



V and n(Pi,P2)|B2 ^ 7r|B2 ^nd 11 (^1, ^2)^2 ^ ^lAa 



> 



If no such vr exists then do not label the edge. 

Fix Ai,Bi. We will choose the universal constant h' to be at least 2 ■ hi. If the probability of 
passing the P^-test conditioned on ^i,i3i is at least e/2, then we claim that the edge is labeled. 
Indeed, define an assignment n^^^^^^) by 

U^M,B,){A2) = n(^i,^2)|A2 and U^A,,B,)(B2) = n(Pi,P2)|B2 

If 11(^1, _Bi) passes the P-test with probability at least e/2, then by Theorem 12.11 there is an assign- 
ment TT as needed (since h' >2 ■ hi). 

Furthermore, observe that by averaging at least e/2 of the edges {Ai,Bi) have conditional 
success at least e/2, so {Ai,Bi) is labeled. 



Step 2. Fix Pi and let L{Bi) be the labels on edges touching Pi. Consider the following "prun- 
ing" process: arbitrarily choose a label vr E L{Bi) and remove all elements in L{Bi) that are within 
relative Hamming distance 3ai of vr. Repeat until no more labels can be removed. Let L'(Pi) 
denote the remaining set of labels. The set L'(Pi) has the following properties 

• Every pair of labels in L'(Pi) are at least 3ai apart, and 

• Every / G L{Bi) is 3ai-close to some label in L'(Pi). 

We prove that |L'(Pi)| < 0(l/e^), using an argument in the spirit of the Johnson bound: Suppose 
L'(Bi) = {tti,tt2, . . .} is non-empty. For every VTj 7^ ttj G L'{B) let us denote 



Pi 



def 



Pr 

B2 

Pr 

B2 



n(Pl,P2)|B2 ^ '^i\B2 



n(Pi,P2)|B2 ^ '^i\B2 and n(Pi,P2)|52 ^ ^ilB2 
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By the definition of the labels vTj, we know that for some universal constant t] it holds that pi > rj-e^ 
for every tTj. We upper bound the fractions pij: We know that for every tTj ^ ttj it holds that 



TTj 96 TTj 



It follows that 



< 1/ 
1 



2-ai 



where the second inequality follows by Lemma 12.31 and the third inequality holds for sufficiently 
large choice of h' . Now, by the inclusion-exclusion principle that 



\L'{B,)\.{n-e')--\L'{B, 



i i^j 
,2 ll 



2 ' 



< 1 



The last inequality immediately implies that |L'(i?i)| < 2/ (77 • e^) = 0(l/e^). 

We define -C'(^i) similarly, and prune it to L'{Ai). Imagine now choosing a random ttai £ L'(A) 
for each Ai and a random ttb^ € L'{Bi) for each Bi. An edge (Ai, Bi) is called alive if it is labeled 
by a function vr that is 3a'-close to both t^Ai and ttbi- We expect at least 1/ |L'(A)| |L'(S)| = Jl(e^) 
fraction of edges to be alive. Fix a choice of tta-^ and tib^ for each Ai and i?i in a way that attains 
this expectation. 



Step 3. Let Vi be the distribution of choosing a random di-subspace Bi and two neighbors Ai, A'^ 
of it in the graph. Let V2 be the distribution of choosing two do-spaces Ai, A'-^ independently and 
a random Bi that is a common neighbor of them in the graph. The statistical distance between 
Pi and P2 is small: 

Claim 9.4. For every k € N, if the constant h' is sufficiently large then the distributions T>i and 
D2 o-^G S-close for 6 < e^^ / n. 

We defer the proof of this claim to Section 19.1.21 Now choose a random triplet Ai , A[ , Bi 
according to T>i. We lower bound the probability that both edges {Ai,Bi) and {A[,Bi) are alive. 
This certainly holds if (i) f^(e^) fraction of the edges adjacent to B are alive, and (ii) both both 
edges {Ai,Bi) and {A[,Bi) are alive. Part (i) holds with probability and conditioned on 

this, Part (ii) holds with probability at least Altogether 

Pr \(Ai,Bi), (A[,Bi) are both alive] = Jlfe^^). 

Finally, if we let 5 be the statistical distance of T>i and P21 and apply Claim \9M with sufficiently 
large choices of k and h', then we have that 

Pr \(Ai,Bi), (A[,Bi) are both alive] > fife^^) _ 5 = rjfe^^). 

(Bi,Ai,A'i)~02 

Now fix Ai such that the above holds when conditioning on Ai. This means that for at least r2(e^'*) 
fraction of the do-subspaces A[ there exists a di-subspace Bi such that both the edges {Ai,Bi) 
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and {A'^,Bi) are alive. For each such A[, it holds that the label of {A'i,Bi) is 3ai-close to ttbi, 
which in turn is 3ai-close to the label of the edge {Ai,Bi), which is 3ai-close to vr^^. Thus, the 
label of {A[,Bi) is is 9ai-close to ttai- denote by n^j^, the label of the edge {A[,Bi). 

Recall that by the definition of vr^^, it holds that 



Pr 

^2,-52 



V and n (a;, ^2)1^^ S ^K,ijOl^J - ^ 



(12) 



9-01 



Since vr^^, ~ tta it holds by Lemma [231 that for a uniformly distributed do-subspace A2: 



Pr 

A2 



TT 



10-ai 

{A[,Bi)\A2 ^ ^Ai|A2 



< 



1 



qdo-2 . (q,^ _ g-a!o)2 

The latter expression can be made smaller than any constant times by choosing h' to be suffi- 
ciently large. By subtracting that expression from Inequality 1121 we obtain that 

lOai 



Pr 

^2,^2 



V and n (^'1,^2)1^^ ^ ^(A;,iJi)|A2 and TT(^A[,Br)\A2 ~' ^^11^2 > ^ {^^) 
By letting tt2 = t^a-i and choosing d = 28, we have by the triangle inequality 



Pr 

A'i,A2 



V and n (^'1,^2 



ll-Q, 



'IA2 



^21^2 



> ^{e'*) ■ n (e^) = nie' 



(13) 



Step 4 It remains to show that the assignment 11 agrees with both vri and tt2 on a non-negligible 
fraction of the S's. To this end, we observe that 



Pr 



V and U{Ai,A2)iAo ^^^^ ^21^2 



n(Bl,B2)|B, Vr2|B2 



< 



1 



To see it, note that it suffices to prove that 
Pr 



n{Bi,B2)iAo '^2\A2 



n(i?i,i?2)|B2 '¥'vr2|B2 



< 



■jdo— 2 



(ai 



?^o-2 . (q,i/2)^ 



< 



(14) 



7^0—2 



(ai/2)^ 



The latter inequality is an immediate corollary of Lemma [ 

Now, by choosing h' to be sufficiently large so that the upper bound in Inequality O is sufficiently 
smaller than , and by combining Inequality [13] with Inequality [U we obtain that 



V and n(Ai,A2)|^2 ^2|A2 and n (51,^2) 7r2|B2 



Pr 



By setting h' such that a' > 12 • ai this concludes the proof of Lemma [97 



9.1.2 Proofs of Auxiliary Claim 



Proof of Claim 19.41 Fix k G N. In order to prove the claim, consider the event J which holds if 
and only if A and A' are disjoint. We argue that 

5/2 5/2 



V2\J 



Do. 



5/2 <5/2 

The fact that T>i\J = T>2\J is exactly Proposition 12.41 We show that T>i ~ T>i\J and T>2 ~ 
T>2\J ■ The statistical distance between 2?i and I'll J (respectively, P2 and T)2\J) is exactly the 
probability that the event J does not occur under Vi (respectively 1^2) ■ It follows immediately 
from Proposition[213]that Pri5^ [^J] < 2-do/q'^^~^ '^o and Prp^ [^J] < 2-(io/g™~^ *. Both the latter 
expressions can indeed be made smaller than e^^/ k by choosing sufficiently large h' , as required. ■ 
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9.2 The proof of Theorems [HI and [831 

In the rest of this section we prove Theorems I5.3h nd I8.5[ 



9.2.1 The proof of Theorem ISTHl 

Theorem (15.31 restated). There exists a universal constants /i, c G N such that the following holds: 
Let e > h ■ do ■ q~'^o/h^ a h ■ d^ ■ q^'^o/^. Assume that di > h ■ do, m > h • di. Suppose that 
a (possible randomized) assignment 11 passes the S-test with probability at least e. There exists 
an assignment n : F"^ E for which the following holds. Let Bi, B2 be uniformly distributed 
and disjoint di-subspaces o/F™, let Ai and A2 be uniformly distributed do-subspaces of Bi and B2 
respectively, and denote A = Ai + A2. Then: 



Pr 



n(Bi,52)|Mi,A2) =n(^)|Mi,A2) andn(Bi,B2) ~7r|(B,,B,) =n{e' 



Remark 9.5. Note that in the foregoing restatement of Theorem 15.31 we denote the first universal 
constant by h, while in its original statement it was denoted by h' . 

The intuition that underlies the proof is the following. Consider an adversary the chooses the 
proof n. Since the S-test essentially contains a P^-test, the adversary must choose the assignment 
n such that for random do-subspaces Ai and A2, the assignment H (^1 + ^42)1^^^ is consistent 
with two assignments vri, 7r2 on Ai, A2 respectively. On the other hand, given the sum Ai + A2, 
the adversary can not deduce the choices of Ai and A2, and therefore he must label both of Ai 
and A2 with the same assignment in order to make the S-test accept. We conclude that vri and tt2 
must be essentially the same. Details follow. 

Let h' be the universal constant whose existence guaranteed in Theorem l9.lt and let a' be the 
corresponding value from Theorem 19.11 We choose c to be the same constant as in Theorem 19. 1^ 
and will choose the universal constant h to be at least h' . 

Fix an assignment 11 that passes the S-test with probability at least e. We define a new 
assignment 11' that assigns values to pairs of do-subspaces and to pairs of di-subspaces of F'" (not 
necessarily disjoint) by choosing U' [Bi, B2) (respectively 11' (^1,^42)) to be equal to Il{Bi,B2) 
(respectively 11 (^1 + ^2)) if Bi and B2 (respectively Ai and A2) are disjoint, and choosing H' to 
be arbitrary otherwise. Observe that the assignment 11' passes the P^-test whenever Bi and B2 are 
disjoint and 11 passes the S-test. Furthermore, the probability that two uniformly distributed di- 
subspaces Bi and B2 of F"* are not disjoint is at most di/q"^~'^''^^ by Proposition 12. 131 and therefore 
n' passes the P^-test with probability at least e — di/g™"^ '^^ . For a sufficiently large choice of h, 
the latter probability is at least Q (e), and also matches the requirements of Theorem 19. H so we can 
apply this theorem. It follows that there exist assignments tti,tt2 : F"* — > S such that for uniformly 
distributed (not necessarily disjoint) Pi, P2, Ai C Bi, A2 ^ P2 it holds that 

Pr[n'(Pi,P2)|(A„A,)=n'(Ai,A2) (15) 

and n' {Ai,A2)^ {n\Ai,-^2\A2) 
and n' (Pi,P2)^ (vri|Bi,vr2|B2)] 

The probability that Pi and P2 are not disjoint is at most di/g"*^^'^^, and the latter expression 
can be made smaller than any constant factor times by choosing h to be sufficiently large. Thus, 
Inequality [TSl also holds for uniformly distributed disjoint Pi and P2. We now argue that 
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5q' 

Claim 9.6. For sufficiently large choice of h, it holds that vri ~ 7r2. 

We defer the proof of Claim 19.61 to the end of this section. We turn to prove the theorem. By 
InequaUtv [T5l it holds for uniformly distributed and disjoint di-subspaces Bi and B2 of F™' that 



Pr 



n'(Bi,i?2)|(A„A2) =n'(Ai,A2) andn(i?i,B2) ^ (vri|B,,7r2|Bj 



5-a' 



By Claim [9^ it holds that vri « tt2- Since B2 is a uniformly distributed di-subspace of F*", this 
implies by Lemma 12.31 that 



Pr 

We conclude that 



6 a' 



> 1 



7^1-2 . (^/ 



{a' -q-<^^Y 



> 1 



Pr 

> Pr 



7-a' 



n'(Bi,B2)|(Ai,A2) =n'(Ai,^2) andn(5i,B2) « {^1\B,,T^1\B,) 



n'(Si,B2)|(Ai,A2) = n'(Ai,^2) and n(5i,52) ^ (vri|£.^,7r2|i32) and vrii^a t^2\B2 



g'^i-s . (a'/2) 



where the last equality holds for sufficiently large choice of h. the theorem now follows by defining 
vr = vTi and setting h to be sufficiently large such that a = 7 ■ a' . 



5-a' 



Proof of Claim [9.61 For the sake of contradition, assume that tti 96 112. Let A be a uniformly 
distributed 2 • do-subspace A of F™ and let Ai and ^2 be uniformly disributed and disjoint do- 
subspaces of A. By Lemma [2T3l it holds that 



Pr 



4-a' 



> 1 



> 1 



4-«' 2 a' 2-a' 

If TTxi^i 96 7r2|A then by the triangle inequality it either holds that LI (A) 96 t^i\a that 11 (A) ^ 
TT2\A- Since Ai is a uniformly distributed do-subspace of A, it holds by Lemma 12.31 that 



Pr 



2-a' 

n(.4) 96 



> 1 



1 



g2-do-2 . (^72) 



A similar claim can be made for 112 and A2. Now, if either n(A)|^^ 96 7rx|yi^ or n(A)|^^ 96 7r2|A2 

a' 

then by definition it holds that 11 (A)^-^^ 96 (7111^^,7121^2)- We conclude that 



Pr 



Lt 

n(^)|(Ai,A2) 9^ (^l|Ai,^2|A2 



4-q' 

TTllA 7^ 7r2|A 



> 1 



g2 rfo-2 . (^,72)^ 



and therefore by lifting the conditioning and substituting A = A1+A2 we obtain that for a uniformly 
distributed and disjoint do-subspaces Ai and A2 of F™ it holds that 



Pr 



n(^l +^2)|(Ai,A2) ^ (^llAi,^2|A2) 



< 
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On the other hand, by the definition of 11', Inequality 1151 implies that for uniformly distributed 
and disjoint dg-subspaces Ai and A2 of F"* it holds that 



Pr 



n(^l + ^2)|(Ai,A2) ^ (^l|Ai,7r2|A2) 



By choosing h to be sufficiently large, the latter lower bound can be made larger than 2/ ( q^ '^" ^ • {a'Y 
and this is a contradiction. 



9.2.2 The proof of Theorem [83] 

Theorem 9.7 (I8.5( restated). There exist universal constants /i, c € N such that for every do € N, 
di > h ■ do, and m > h ■ di, the following holds: Let e > h ■ do ■ q~'^o/h^ a'^= h ■ do ■ q^'^a/^. Let H 
be a (possibly randomized) assignment to 2do-subspaces ofF"^ and to pairs of di- sub spaces ofF"^. 
Then, there exists a (possibly empty) list of L = 0{l/e'^) assignments 7r^,...,7T^ : F"^ — >■ E such 
that 



Pr 



n(^) 



(Ai,A2) 



and ^i £ [L] s.t. U{Bi,B2) ^ vr 



l(fil,B2) 



< e 



Remark 9.8. Note that in the foregoing restatement of Theorem 18.51 we denote the first universal 
constant by h, while in its original statement it was denoted by h'. 



The basic idea of the proof is as follows. We apply Theorem 15.31 to IT, thus "decoding" from it 
an assignment vr^. We then remove from 11 the places at which it roughly agrees with vr^, resulting 
in an assignment 11^. If the assignment 11^ is accepted by the S-test with probability less than e, 
then we are finished - the required list of assignments in this case consists only of vr^. Otherwise, the 
assignment 11^ is accepted by the S-test with probability at least e, and we can therefore "decode" 
a second assignment tt^ from 11^. Next, we remove from 11^ the places at which it roughly agrees 
with TT^, resulting in an assignment 11^. We proceed in this manner, each time obtaining new 
assignments 11* and vr*, until the conclusion of Theorem 18.51 holds. 

We prove Theorem 18.51 only for non-randomized assignments 11, but the proof can easily be 
extended to randomized assignments, see Remark 19.91 for details. We choose the constants h and 
c to be the same as in Theorem 15. 3[ If the S-test accepts 11 with probability less than e then the 
theorem holds vacously. We thus assume that the S-test accepts 11 with probability at least e. We 
show that for L = O there exist assignments vr^, . . . , vr^ : F™ — )• S such that 



Pr 



Pr 



n(Bi,B2)|(Ai,A2) = n(^)|(Ai,A2) 

n(i?i,i?2)|(A„A2)=n(^)|(A,A2) and 3i e [L] : n (51,52)^4^^,5,) 



(16) 



< e 



We construct the assignments tt^,...,tt^ as follows. We begin by applying Theorem 15.31 to 11, 
obtaining the assignment vr^, and set 11^ *== 11. Then, for each i > 1 we define an assignment H*"*"^ 
as follows. 

1. For every pair of di-subspaces Bi, B2 such that 11' (Bi,B2) ~ '^\{Bi _B2)' n*"*"^ {Bi, B2) = 

_L, where _L is a special symbol that the test always rejects. This is our formal way of 
"removing" (51,^2). 
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2. For every pair of di-subspaces Bi, B2 such that 11* {Bi,B2) 96 tt*^^^ we set {Bi, B2) 
W{Bi,B2). 



3. For every 2do-subspace A, we set {A) = W {A). 
Now, observe that 



(17) 



Pr 



since we must have 11*+^ {Bi, B2 



(i3l,i?2)|(^„A2) = (^)|(A„A2) A (i3i,B2) « 4^^,^^) 

whenever n*+i (^1,^2) 



(A) 



(^1,^2) 



1(^1,^2) 



_L, and 



(A) 



l(Al,A2) 



the latter occurs whenever H* (i?i, i?2) ~ _B2)' -'■^-^^ 
then we set L = i and finish the construction. Otherwise, we construct vr*"*"^ by applying Theo- 
rem [531 to the assignment and setting tt*"'"^ to be the resulting assignment. 
It is easy to prove by induction that for every i G [L] it holds that 



< e 



Pr 



Pr 

ACB 



ff+l(i?l,i32)|(^^,^^)=ff+M^)|(A„A2) 

n(Si,S2)|(^^_^2) = n(^)|(Ai,A2) 
n(Si,S2)|(^^_^2) = n(^)|(Ai,A2) 



(18) 



Pr 



and 3i £ [L] : Ui (Si, S2) S vrf^^^^^^) 



The proof of the Equality [18] goes essentially by summing over the probabilites of events of the 
form 

n* (i?i,i?2)|(^,,^,) = (^)|(Ai,A2) and (i?i,i?2) « vrf(^^,B^) and < i s.t. W {B,,B2) S ^^^^^^^ 

for different values of i. 

Finally, by combining Equality [TSj with the fact that 



Pr 



n 



L+l 



{Bi,B2 



1(^1,^2) 



n 



L+l 



(A) 



\{Ai,A2) 



< £ 



it follows that the assignments tt^, . . . ,tt^ satisfy Inequality [T6j To see that L = O (l/e'^), observe 
that for each i we have that 



Pr 



(51,^2) 



nM^)|(A„A2) and n^Si, 52)^4^^,5,) =nie 



By Equalitv llTl this implies that the acceptance probability of 11*+^ is smaller than the acceptance 
probability of 11* by at least e^, and therefore that the number of iterations can be at most O {l/e"^), 
as required. 

Remark 9.9. As in the proof of Theorem 19. 11 if 11 is randomized, then for each i the definition of 
jjj+i siiould be slightly changed to consider the internal randomness of 11*. That is, we define 11*"'"^ 
to be a randomized assignment, and obtain it from 11 as follows. For every pair (i?i, B2) and every 
internal randomness w of 11*, let us denote by (61, 62) the output of Ilj on {Bi, B2) and randomness oj. 



We define the output of n*"*" on {Bi,B2) and randomness a; to be _L if (61,62) ~ B2)' 
define it to be (61, 62) otherwise. The definition for 2(io-spaces A can be changed similarly to include 
the internal randomness of 11* . 
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A Proof of Theorem 12.11 

In this section we prove Theorem 12. H restated below. Let F be a finite field of size q, let m, do, di G 
N, and consider a (possible randomized) assignment 11 that assigns values to do- and di-subspaces 
of F™. 

Theorem A.l (j2.1l restated). There exists a universal constant /i G N such that the following 
holds: Let e > h ■ do ■ q~'^o/h^ a *== /i • do • q^'^<^/^. Assume that di > h ■ do, m > h ■ di. Suppose that 
an assignment 11 passes the P-test with probability at least e. Then, there exists an assignment it 
such that 

where the probability is over A, B chosen as in the P-test. 



Pr 



n(S)|^ = n(^) and n (S) 7r|B andn(A)R:^7r 



1^ 
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We begin by recalling the required preliminaries from |IKW09| . and then turn to prove Theo- 
rem [27T1 

Definition A. 2 (Good). Let A be a do-subspace of and let e G (0, 1). We say that A is e-good 
(with respect to an assignment IT) if for a uniformly distributed di-dimensional subspace B that 
contains A it holds that 



Pr 



U{B)^^ = U{A) 



> e 



where the randomness is over the choice of B and over the randomness of 11. 

Definition A. 3 (Plurality function). Let ^ be a do-subspace of F"^. We denote by tta ■ F"^ T, 
the plurality function of A (with respect to H). In other words, for every x G F™ we define ita{x) 
to be the value t; G S that maximizes 



Pr 

BDA 



11(B) 



U{B)^^ = U{A) 



where i? is a uniformly distributed di-dimensional subspace that contains A. 

Definition A. 4 (DP-consistent). Let ^ be a do-subspace of F™ and let a,7 G (0, 1). We say that 
A is {e, a, j)- direct product consistent (abbreviated (e,a,7) -DP-consistent) if A is e-good and it 
holds that 



Pr 

BDA 



u{B)^7r^\s n(s)|^ = n(A) 



> 1 - 7 



The following lemma is a direct corollary of the proofs of |IKW09t Lemma 4.2] and |IKW09t 
Lemma 4.4]. 

Lemma A. 5. There exists a universal constant ho N such that the following holds: Let e > 
ho ■ q~^'^'^/^o-d,o) Qjj^ a,7 G (0, 1). The probability that a uniformly distributed A is e-good but not 
(e, a, "f) -DP-consistent is at most 0[l/ (a • 7 • • q'^°~'^)) . 

Proof of Theorem 12.11 

We will choose the universal constant h to be larger than ho (where ho is the constant from 
Lemma lA.Sp . Assume that the P-test accepts with probability at least e as in the statement of the 
theorem. Let ei = ^ ■ e and 71 = . Choose ai = O (l/ef • 71 • g'^O"^) such that the probability 
in Lemma lA.51 that A is ei-good but not (ei, ai, 7i)-DP-consistent is at most ei, which is indeed 
possible for sufficiently large choice of h. We will later choose a = O (ai), by choosing again h to 
be sufficiently large. 

We consider the following sequence of events. Let ^1,^2 denote random do-subspaces, and let 
B denote a random di-subspace, and define events Si,S2,Ss as follows: 

1. Si{Ai, A2, B) : A\ and A2 are (ei, ai, 7i)-DP-consistent and n(i?)|^^ = n(j4i), Vi{B)^j^^ = 

n(^2). 

2ai 

2. 52(^1,^21-6) : The event Si {Ai, A2, B) occurs and vr^^is ~ '^A2\B (recall that vr^^ and vr^a 
are the plurality assignments of Ai and A2 respectively). 

3. 53(^41,^2): Ai and A2 are (ei, ai, 7i)-DP-consistent and ttai '^A2- 

In the next three claims we choose Ai, A2 and B according to the following distribution: choose Ai 
and A2 to be uniformly distributed and disjoint do-spaces Ai, A2, and a choose to be a uniformly 
distributed di-subspace that contains them. We show that the probability of events 5i, ^2, ^3 under 
this distribution is non-negligible. 
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Claim A.6. Pr[Si] > n (ef ) . 

Proof Let B' be a uniformly distributed di-subspace of F"^ and let A' be a do-uniformly distributed 
subspace of B'. We begin by lower bounding the probability 



Pr 



n = n {A') and A' is (ei, ai, 71) -DP-consistent (19) 



To this end, let us denote by V the event that Il{B')^^, = Il{A'), by V the event that A' is 
(ei,Qi,7i)-DP-consistent, and by Q the event that A' is ei-good. Observe thatPr and -^Q] < 
Pr[7-'|-'^] < ei. Furthermore, A' is a uniformly distributed do-subspace of and thus by 
Lemma IA.5I and our choice of ai, it holds that Pr and -^T>] < £1. Finally, it holds that the 
probability in ([19]) is 



Pr [V and V] > Pr [V and G and V] 

= Pr [P and G] - Pr [V and G and -^V] 

= Pr [P] - Pr [V and - Pr [V and ^ and ^P] 

> Pr [-P] - Pr [P and - Pr [Q and ^P] 

> e — El — El 

> ei 



So the probability in (I19p is at least ei. By averaging, this implies that for il. (ei) fraction of the 
di-subspaces B' it holds that at least $7 (ei) fraction of the do-subspaces A' of B' are (ei,ai,7i)- 
DP-consistent and satisfy 11 = n {A'). 

Now, observe that by Proposition 12.41 the distribution over ^1, is equivalent to choosing 

S to be a uniformly distributed di-subspace of F™' and then choosing Ai and A2 to be disjoint 
uniformly distributed do-subspaces of B. With probability at least 0, (ei) it holds for B that at least 
n(ei) fraction of the do-subspaces ^ of i? are (ei, ai, 7i)-DP-consistent and satisfy H = n(^). 

We condition on the latter event, and claim that under this conditioning the event Si{Ai, A2, B) 
occurs with probability at least Q (ei). To see it, consider two uniformly distributed {not necessarily 
disjoint) do-subspaces A'^ and A2 of B. Then, by our conditioning, it holds that Si{A[, A'2, B) occurs 
with probability at least Q (e|) . Furthermore, by Proposition 12.13] it holds with probability at least 
1 — 2 • do/q'^^~'^''^° that A[ and A2 are disjoint. It therefore follows under the foregoing conditioning 
on B that 

Pr[Si{Ai,A2,B)] = Pr[5i (^'1,^^,5) I .4^ are disjoint] 

> Fr[Si{A[,A'2,B) and A[,A2 are disjoint] 

> Pr [Si {A[ , A'2 , B)] - Pr [A[ , A'2 are disjoint] 

> l^(e?) -2-do/g'^i-2-'^° 

> ^{el) 

where the last inequality holds for sufficiently large h. Lifting the conditioning on B, we get that for 
a uniformly distributed di-subspace B of F™ and two disjoint uniformly distributed do-subspaces 
Ai and A2 of B, it holds with probability at least Q (ef) that both Ai and A2 are (ei, ai, 7i)-DP- 
consistent and that 11 = 11 (^1), 11 (-B)j^^ = 11 (^2)) as required. ■ 

Claim A.7. Pr[cS2] > n (ef ) . 
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ai 



Proof Let £i be the event in which Ai is (ei, ai, 7i)-DP-consistent, 11 (^)|^^ = H (Ai) and 11 (B) 96 
'^Ai\Bi ^-iid let £2 be the corresponding event for A2. We begin by noting that the probabihties 
of both £1 and £2 are upper bounded by 71. To see it for £1, note that conditioned on Ai being 
(ei, cti, 7i)-DP-consistent and on n(i?)|^^ = n(j4i) it holds that i? is a uniformly distributed di- 

ai 

subspace satisfying 11 = 11 (Ai), and therefore it holds that 11 (B) 96 t^Ai\b with probability 

at most 7i (by the DP-consistency of ^1). The probability of £2 can be upper bounded similarly. 
It now follows by Claim [A?6l that 



Pr ISo 





Pr Si 


> 


Pr [Si 


> 


Pr [Si] 


> 




> 





2ai 



Si and ttai\b 

ad -^£1 and ^6 
Pr [^1] - Pr [£2 
2-71 



where the last inequality holds for sufficiently large choice of h. The required result follows. ■ 
Claim A.8. Pr[53] > Q (ef ) . 

Proof Let us say that Ai and A2 are "agree on a random B" if both Ai and A2 are (ei, ai, 7i)-DP- 



consistent and FvbdAi,A2 



2-ai 

T^Ai\B ~ '^A2\B 



> Q (ef)- By Claim IATtI and by averaging, we know 



that with probability at least $7 (^efj it holds that Ai and A2 agree on a random B. We show that 

for every Ai and A2 that are (ei, ai, 7i)-DP-consistent such that ttai 9^ '^A2 it holds that Ai and 
A2 do not agree on a random B. This will imply that if Ai and A2 agree on a random B then 

it must hold that tt^^ ~ '^A2- Since we know that the probability of Ai and A2 to agree on a 
random B is at least Q (ef) the required result will follow. 

Fix Ai and A2 to be any (ei, ai, 7i)-DP-consistent disjoint do-subspaces such that ttai 7^ 
TTyij. Now, by Lemma 12.31 and by sufficiently large choice of h, the probability that a uniformly 
distributed di-subspace B that contains Ai and A2 contains at most 2 ■ ai < 3 ■ ai — — 
l/qd-i-'^-d-a fraction of coordinates on which ttai and vr^j disagree is at most 1/ (g'^i-4 do-6"j ^ 
the latter expression can be made smaller than any constant factor times ef. Thus, it holds that 

PrBDAi,A2 Trails ~ '^A2\B 
a random B, as required. 



can be made sufficiently small such that Ai and A2 do not agree on 



We now find a global assignment vr and show that it agrees with n on many S's, and then on 
many ^'s. 



Claim A. 9. There exists an assignment vr : F™ 
n (A)] > Q {ef) . 



E such that PrB[n(i?) w VTj^ and n(i?)|^ 



Proof By Claim lAlSl and by averaging, we get that for at least O (ef) fraction of the cio-subspaces 
Ai it holds that Ai is (ei, ai, 7i)-DP-consistent and 



Pr 

A2:A2 is disjoint from Ai _ 



3ai 



A2 is (ei, ai, 71) -DP-consistent and TTyi^ tta^ 
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Fix such do-subspace Ai , and set vr = tta-^ ■ Consider choosing a uniformly distributed do-space A2 

and a uniformly distributed di-space B D A2. We show that n(i?) ~^ tt^^ with probability at 
least Qi^ef). 

Let us denote by V the event in which A2 is disjoint from Ai, hyV the event in which H {B)^^^ = 

11(^2)5 and by C the event in which A2 is (ei, ai, 7i)-DP-consistent and vr^^ ~^ tt/Ij- 

By Proposition 12.131 it holds that Pr [T?] > 1 — 2 • do/q"^~'^''^° > ^ (where the second inequality 
holds for sufficiently large h). Furthermore, conditioned on D, the subspace A2 is a uniformly 
distributed do-subspace of F*" that is disjoint from Ai, and thus by the choice of Ai it holds that 
Pr > n (ef). Lifting the conditioning, it follows that Pr [C] > n [ef). Next, ob serve that B 
is distributed uniformly over the di-subspaces that contain A2, and thus (since in particular A2 is 
ei-good) Pr [V\C] > ei. It therefore holds that Pr [C and V] > Q {ef) 

Now, let us condition on the events C and V. By Lemma 12.31 and for sufficiently large h, 
it holds with probability at least 1 — 1/ (q'^i~3-rfo-6^ > 3 ^^j^^^ contains at most 4 • ai > 3ai + 
I ^ qdo-2 ^ qdi-2-do fraction of coordinates on which tta^ and 11^2 disagree. Furthermore, by the DP- 
consistency of A2 and for sufficiently large choice of h, it holds with probability at least 1 — 71 > | 
that n (B) ~ 7r^2|B- union bound and the triangle inequality, it follows that with probability 

at least ^ it holds that Il{B) disagrees with vr^^i^ on at most 5 • ai fraction of the coordinates. 
Lifting the conditioning on C and V, we obtain that with probability at least Q (e|) it holds that 

n (B) vr^i|B, and H (B) = H (^4) as required. ■ 

Finally, we turn to prove the theorem. Let vr be the assignment whose existence is guaranteed 
by the previous claim. Let us denote by V the event in which Il{B)^^ = n (^) (i.e., the P-test 

accepts A and B), by £1 the event in which Il{B) ~^ tt^^, by £2 the event in which Il{A) ~^ 7r|^, 

and by £3 the event in which H [B)^^ ~ 7r|^. Using this notation, it suffices to prove that 

Pr [V and £1 and £2] = Q {ef) 
By the definition of vr, it holds that 

Pr [V and ^i] = Q (ef) 

The subspace ^ is a uniformly distributed do-subspace of B, and therefore it holds by Lemma 12.31 
that 

PrK3|fi]=0(l/g'^«/2-2^ 

This implies that 

Pr [V and £1 and £3] = Pr [P and ^i] - Pr [V and f 1 and ^£^3] 

> Fi[V andfi] -Prh£:3|£:i] 
= 17 (ef) - O (l/g*'/2-2) 

where the last inequality holds for sufficiently large h. Now, observe that whenever both the events 
V and £3 occur, the event £2 also occurs. It follows that 

Pr [V and £1 and £2] > Pr [P and f 1 and ^3] = Q {ef) 

as required. 
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B Routing on de Bruijn graphs 



In this section we prove the routing property of de Bruijn graph given in Fact 14.51 Recall the 
following. 

Definition (j4.H restated). Let A be a finite alphabet and let m G N. The de Bruijn graph 'DB\^rn 
is the directed graph whose vertices set is A™ such that each vertex (ai, . . . , at) € A™ has outgoing 
edges to all the vertices of the form (02, . . . , a*, /?) for /3 € A. 

Fact (14.51 restated). Let T>B\^rn be a de-Brujin graph. Then, given a permutation fi on the vertices 
of VBA^m one can find a set of undirected paths of length I = 2m which connect each vertex v to 
fi{v) and which have the following property: For every j G [/], each vertex v is the j-th vertex of 
exactly one path. Furthermore, finding the paths can be done in time that is polynomial in the size 

ofVBA^rn- 

We actually prove the following slightly stronger result, which says that if the permutation n 
acts only on the i last coordinates of its input then the routing can be done in only 2i steps. 

Claim B.l. Let T>B\^m be a de-Bruijn graph and let i € [m]. Then, given a permutation fi on 
A* one can find a set of undirected paths of length 2 • i that connect each vertex (ai, . . . ,am) of 
VB\^„i to the vertex (ai, . . . , a„i-i-,pi' (om-i+ii • • • ; O-m)) and that have the following two property: 
For every j E [/], each vertex v is the j-th vertex of exactly one path. Furthermore, finding the 
paths can he done in time that is polynomial in the size of TyBx^rn- 

The proof works by induction on i. For i = the claim is obvious. Assume that the claim holds 
for some < i < m. We prove that the claim holds for i + 1. Let VB = VB^^m, and let /i be a 
permutation on A*+^. For convenience, let us define the action of /i on each (ai, . . . , am) G F*" as 
^ (ai, . . . , am) = (ai, • • • ,am-i-i, l^{am-i, • • • , am))- 

Let G be the directed graph whose vertices are the set A™ and whose edges are all the pairs of 
the form {v,fi{v)). Let G' be the graph that is obtained from G by contracting each |A| vertices 
of G that agree on their last coordinate to one vertex. Clearly, every vertex in G' has in-degree 
and out-degree exactly |A|, and each edge of G' corresponds to an edge of G. Furthermore, observe 
that the vertices of G' can be identified with the vertices of A"^~^. 

The |A|-regularity of G implies that the edges of G' can be partitioned to [A[ perfect matchings 
{G^}^g^ in polynomial time (see, e.g., [Cam98( Proposition 18.1.2]). Fix a matching G'^, and 
consider an edge e' in G'^. Observe that if e is coming out of a vertex (ai, . . . , Om-i) of G', 
then it must enter a vertex of the form (ai, . . . , am-i, ctm-i+i' • • • ' "^m-i)- Thus, we can define a 
permutation Va- on A* that maps {am-i, ■ ■ ■ , ctm-i) to (a^_j, . . . , aj^-i) for each such edge e'(since 
G'^ is a perfect matching, this is well defined). We now invoke the induction hypothesis on the 
graph VB = T>B\^m to find a set of paths Va of length 2i for each permutation v^j . 

We construct the required paths for ^ as follows. Let v = (ai, . . . , am) G A*", and suppose that 
^ {am-i, ■ ■ ■ , OjTi) = {oi'm-i, ■ ■ ■ , ^m) • We wish to construct a path p in VB that connects v to fi {v). 
The edge (v, fi {v)) corresponds to some edge e' in G', so let G'j^ be the matching to which e' belongs. 
We turn to construct the path p: The first edge in the path p connects v = (ai, . . . ,am) to the 
vertex ai, . . . , am-i)- The next 2i edges of p will be the edges of the path in that connects 
(/3,ai, . . . ,am-i) to (/3, Oi , . . . , am—i—l, Oim—i ; • • • ' ^m— 

i) . Finally, the last edge of p will go from the 
vertex qi, . . . , a^-i-i, a^_j, • • • , a^_i) to the vertex {ai, . . . ,am-i-i,a'^_i, ■ ■ ■ ,a'^) =/"(■")• 
Observe that p indeed connects v to ^ {v) and is of length 2 • (i + 1) 

It remains to show that for each j € [2z + 2] it holds that every vertex v is the j-th vertex of 
exactly one path. The cases of j = 1 and j = 2 ■ i + 2 are trivial. We analyze the case of j = 2, and 
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the rest of the cases will follow from the induction hypothesis. Let u = (/3, ai, . . . ,am-i) £ A™. 
We show that u is the second vertex of a unique path p by constructing p. Let e' be the unique 
edge of G' that comes out of the vertex (qi, . . . , am-i) and that belongs to the matching G'^. The 
edge e' of G' corresponds to some unique edge {v, fj, (v)) of G. Now, by construction, the only path 
p such that u is the second vertex of p is the path that connects v to ^ (v). The required result 
follows. 



In this section, we prove Claim \57l\ restated below. Recall that G = (F™,£') is a graph with linear 
structure and in particular £^ is a linear supspace of edges. 

Claim (15. 7|. restated). Let d € N and let Ea be a uniformly distributed d-subspace of E. Then, 
Pr [dim (left {Ea}) = d] > 1 — d/q'"^"'^, and conditioned on dim (left {Ea)) = d, it holds that left {Ea) 
is a uniformly distributed d-subspace ofW™'. The same holds for right {Ea). 

More generally, let Ejj be a fixed subspace of E such that dim(E';,) > d and dim (left (E';,)) > 
d. Let Ea be a uniformly distributed d-subspace of Ei,. Then, Pr [dim (left (E'a)) = d] > 1 — 
^^qdim{lc{t{Et))~d ^ and conditioned on dim (left (E'a)) = d, it holds that left (ii^^) is a uniformly 
distributed d-subspace o/left {Ei,). Again, the same holds for right {Ea). 

Proof We prove the proposition only for special case in which Ef, = E and only for left {Ea). The 
proof of the general case and of the case of for right {Ea) is analogous. Let ei, . . . , be independent 
and uniformly distributed vectors of E, and let E'a = spanjei, . . . ,6^}. We prove Proposition 15.71 
by showing that Ea is distributed similarly to E'^, and analyzing the distribution of E'^^. 

Observe that by Proposition 12.141 it holds that conditioned on dim {E'a) = d, the subspace E^ 
is a uniformly distributed d-subspace of E. It therefore holds that 



where the last equality holds since clearly dim (left (ii^^)) = d implies dim(i?^) = d. Now, since 
left (•) is a linear function, it holds that left (ei) , . . . left (e^) are independent and uniformly dis- 
tributed vectors of left {E) = F™, and therefore by Proposition l2.14l it holds that Pr [dim (left {E'^)) = d] > 
1 - d/g"-''. It thus follows that Pr [dim (left {Ea)) = d] > 1 - d/q^''^, as required. 

It remains to show that conditioned on Pr [dim (left {Ea)) = d] it holds that left {Ea) is a uni- 
formly distributed d-subspace of F™. To see it, observe that for every fixed d-subspace D of F™, it 
holds that 



Pr [left {Ea) = D\ dim (left {Ea)) = d] = Pr [left {E'a) = D\ dim {E'a) = d and dim (left {E'a)) = d] 

= Pr [left {E'^) = £»| dim (left {E'^)) = d] 



where the first equality again holds since conditioned on dim {E'a) = d it holds that E'a is a uni- 
formly distributed d-subspace, and the second equality again holds since dim (left {E'a)) = d implies 
dim {E'a) = d. Now, it holds that left {E'a) is the span of d uniformly distributed vectors of F™, and 
therefore by Proposition 12. 141 it holds that conditioned on dim (left {E'a)) = d the subspace left {E'a) 
is a uniformly distributed d-subspace of left (i?;,). This implies that the probability 



C Proof of Claim [513 



Pr [dim (left (Ea)) = d] 



= Pr [dim (left (E;)) 
> Pr [dim (left (E;)) 
= Pr [dim (left (e;)) 



d|dim(E^) =d] 

d and dim (E^) = d] 

d] 



Pr [left {E'a) = D| dim (left [E'a)) = d] 
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is the same for all possible choices of D, and therefore the probability 



Pr [left (Ea) = D\ dim (left = d] 

is the same for all possible choices of D, as required. ■ 

D Proof of Proposition 16.241 

In this section we prove Proposition 16.241 restated below. 

Proposition ()6.24l restated). Let T, S, r{n), q{n), i{n), s{n), and p{n) he as in Definition \6.9\. 
and let ho and do be the constants from Fact \2.17\ If there exists a udPCP D for CiRCUiTSATr 
with the foregoing parameters, then there exists a polynomial time procedure that acts as follows. 
When given a circuit : P* — >■ {0, 1} of size n, the procedure outputs a corresponding decoding 
graph G = {V,E) q{n) ■ do ■ t ■ 2"^^""^ with randomness complexity r{n) + log (do ■ q{n)), alphabet S'^*^"-', 

decoding complexity s{n) + poly log [S(n)[, and rejection ratio Q (^p{n)/ (g(n))^^. Furthermore, G 
is {q{n) ■ do) -regular, and has t ■ 2^^"^ vertices and smoothness 1. 

Fix n G N and let r = r(n), q = q{n), i = £{n), S = S(n), and s = s{n). We describe the 
output of the procedure on fixed circuit (/3 : P* ^ {0, 1} of size n. The procedure outputs a decoding 
graph G defined as follows: 

• The vertices set of G is the set [t] ■ {0, 1}^, whose elements are identified with all the pairs 
(k, uj) where k G [t] is an index to be decoded and cj is a sequence of coin tosses of D on input 
{if, k). We denote by I[k,ui) ^iid V'{fc,aj) ^''^6 the queries tuple and circuit that are output by D 
on input {ip, k) and coin tosses oj. 

• The alphabet of G is S'^. 

• The edges of G are constructed as follows. For every i G [£], we let Q be the set of pairs 
{k,oj) such that on I[k,ijj) contains i. For each i G [£], we consider the expander G\Ci\ over 
\Ci\ vertices from Fact 12.171 find identify its vertices with the elements of Cj. Now, for each 
undirected edge of G|c.[, we put two directed edges between the corresponding vertices in Cj, 
one edge per direction. 

• If an edge is coming out from a vertex {k,(jj), then it is associated with the index k. 

• The circuits V'e associated with the edges are constructed as follows. Let e be an edge going 
from {ki,ijji) to (A;2,a;2), let V'e be the associated circuit. Suppose that {ki,ijji) and {k2,0J2) 
belong to d, so there exist ji, j2 G [q] such that (/(A:i,<^i))^.^ = {I(k2,L02)) = ^- Now, the 
circuit -06 is given as input two tuples a,b £ S'^, outputs _L if aj-^ ^ bj^, and otherwise outputs 

Let i' and n' denote the numbers of vertices and edges of G. It is easy to see that the decoding 
graph G has the correct size, randomness complexity, alphabet, decoding complexity, and number 
of vertices, and also that it is g • do-regular. To see that it has smoothness 1, consider an edge {u, v) 
that is chosen under the decoding distribution and observe that 

• n is uniformly distributed among the vertices of G. 

• Conditioned on the choice of u, the edge {u, v) is uniformly distributed among the edges of u. 
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Combining the two above observations with the regularity of G imphes that the decoding distribu- 
tion of G is the uniform distribution over the edges. 

We turn to show the completeness of G. Let a; be a satisfying assignment for and let tt = tTx 
be the corresponding proof string for D. We define an assignment 11 to the vertices of G by defining 
n(jk,w) to be T^\i^f. ■ It should be clear that this choice of 11 satisfies the requirements. 

It remains to analyze the rejection ratio of G. Let 11 be an assignment to G. For each vertex 
{k,Lo), if for some j € [q] it holds that = i, then we refer to {ll(k,Ld))j as the opinion of 

{k,oj) on i, and also as the j-th opinion of (fe, w). Let tt be the proof string for D defined by setting 
TTi to be the most popular opinion of a vertex of G on i Suppose that D has decoding error e 
on vr and let x be the satisfying assignment to ip that achieves this decoding error. Let e' be the 
decoding error of G on 11 with respect to x. We show that at least ^ • e' fraction of the edges of G 
reject 11, and this will establish the rejection ratio of G. 

Let r] be the fraction of vertices of G that have an opinion that is inconsistent with tt. Clearly, 
e' < e + T]-. To see it, note that for at least 1 — e — r/ of the vertices (k, uj) of G it holds that all the 
opinions of of {k,uj) are consistent with vr and that D does not err on proof string vr and on {k,u}) 

(i.e. ipi^k,w) ^ {-L)^*;})- Then, observe that all the outgoing edges of such a vertex {k,Lu) 

do not err. 

Let k be uniformly distributed over [t]. We consider two possible cases. First, consider the case 
in which rj < p -6/2. By the soundness of D, it holds that D rejects vr with probability at least p ■ e. 
Thus, at least p ■ e fraction of the vertices {k,uj) of G, it holds that D rejects vr on {k,uj). This 
implies that at least {p ■ e — 7]) fraction of the vertices (k,Ld) of G, it holds that both D rejects tt 
on {k,co) and all the opinions of {k,co) are consistent with tt, in which case all the outgoing edges 
of {k,oj) reject 11. It follows that the fraction of edges of G that reject 11 is at least 

p-e-v>p-e/2>^-rj + ^-e>^{ri + e)>^-e' 

as required. 

We turn to consider the case in which rj > p ■ e/2. By averaging, there exists some j G [q] such 
that for at least ij/q fraction of the vertices {k,uj) of G it holds that the j-th opinion of {k,uj) is 
inconsistent with vr. For every i £ [i], denote by Si the set of vertices of Cj whose j-th opinion is 
an opinion on i that is inconsistent with TTj, and observethat 

e 



pi 



\SA > 
1 1 



Fix i G [£] and denote Si = Ci\Si, and note that since vTj is the plurality vote it holds that 
|>S'i| < \Ci\ /2. Now, observe that every edge that goes from Si to Si or vice versa must reject 11. 
By the edge expansion of G\Ci\, the number of such edges is at least ho ■ do ■ \S\. Since this holds 
for every i E [i], it follows that the fraction of edges of G that reject 11 is at least 

1 1 

—: - y^^ho- do-\Si\ = — - — 77 • V'/io • <io • l-Sil 
n' ^-^ q ■ do ■ t' ^-^ 

1=1 1=1 



> 



q.i' ^ 

ho rj 



^ ho 
2 • 
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where the first equahty follows since G is {q ■ (io)-regular. The required result follows. 



E Proof of Proposition 17.41 



In this section we prove Proposition 17.41 restated below. 

Proposition l\7A\ restated). There exists a polynomial time procedure that acts as follows: 
• Input: 

— A vertex- decoding graph G of size n for input circuit ip : F* — > {0,1} with i vertices, 
alphabet S, rejection ratio p, decoding complexity s, degree hound d, and smoothness 7. 

— A number E N such that I' > I (given in unary). 



Output: Let c j and let do and ho be the constants from Fact \2.11\ The procedure 

outputs a vertex- decoding graph G' of size at most 2 • (c + 1) • • n for input circuit ip 
that has exactly C vertices and also has alphabet S, output size s + poly log rejection 
ratio Q, (7^ • p/d"^^, degree bound 2 ■ do ■ d, and smoothness ^ • 7. 

Furthermore, if G is d-regular then G' is (2 • do • d) -regular and has rejection ratio Q, (7^ • p) . 

Let G = {V,E), if, i, and £' be as in the proposition and let z = £' mod £. We construct G' as 
follows. Choose an arbitrary set T C 1/ of size z. The vertices of G' consist of a set C„ of vertices 
for each v € V, where |C^| = c+ l if v & T and |Ct,| = c otherwise. Observe that G' indeed has i' 
vertices. For each f G y let us denote Gy = \^vi, . . . The edges of G' are defined as follows: 

1. For each edge {u,v) of G and for each / E [c], the graph G' has do edges {ui,vi) that are 
associated with the same index /c(„ j,) and circuit '4'{u,v) ^ the edge {u, v) of G. We call such 
edges "G-edges". 

2. For each edge {u, v) for which u ^T, the graph G' contains the following "trivial" edges: Let 
jk = k{y^^y-) and = '4'(u,v) be the index and circuit associated with {u,v). Recall that since 
G is vertex-decoding, there exists a function / : S ^ F such that for every a, 6 E S on which 
•0(0,6) / ±, it holds that V(«,^) = /(a)- Let 0' : ^ F U {_L} be the circuit that for 
every input (a, 6) E outputs /(a). The graph G' contains do edges {uc+i,Uc+i) that are 
associated with the index k and with the circuit ip'. 

3. For each edge {u, v) of G the graph G' contains the following edges, which correspond to 
"equality constraints": Let k = k^^^^-j and ip = ip(u,v) be the index and circuit associated 
with {u,v), and let / : S ^ F as in Item[2l Let i/j' be the circuit that on input (a, 6) E 
outputs _L if a 7^ 6 and outputs /(a) otherwise. We now identify the vertices of Cu with the 
vertices of the expander from Fact 12.171 fo'^ every (undirected) edge of G^q^^ we put 
two directed edges between the corresponding vertices of Cu, where the directed edges are 
associated with the index k and with the circuit We call such edges "consistency edges" 
of u. 

Let n' be the size of G'. It is easy to see that G' has the correct size, alphabet, decoding complexity, 
and degree bound, and also that G' satisfies the completeness requirement. It can also be verified 
that G' has smoothness (^^ ~ '7 ^ ^ '7 using the smoothness criterion (Proposition 16. 22|) and 
a straightforward calculation. 
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It remains to analyze the rejection ratio of G' . Let tt' be an assignment to the vertices of 
G', and let vr be the corresponding plurality assignment to G. That is, vr is the assignment that 
assigns each vertex v of G the most popular value among the values that vr' assigns to vertices in 
Gy. Suppose that G has decoding error e on vr and let x € T* be an assignment that attains this 
decoding error. Let e' be the decoding error of G' on vr' with respect to x. We will show that G' 
rejects vr' with probability at least ■ p ■ e' under the decoding distribution, and this clearly 

suffices since e' is an upper bound on the decoding error of G' . To this end, we will analyze the 
decoding error and rejection probability of G' under the uniform distribution on the edges, and 
then use the smoothness of G' to derive conclusions on the decoding distribution. 

By the smoothness of G', the probability that a uniformly distributed edge of G' fails to decode 

X on vr' is at least e'l '= ^ ■ 7 • e'. Furthermore, a uniformly distributed edge of G fails to decode 

X on vr with probability at least Si 7 • e and rejects with probability at least p ■ ei = 7 ■ p • e. 
Let r] be the fraction of vertices of G' on which vr' is inconsistent with vr. We begin the analysis by 
expressing e'^ in terms of £1 and r/. 

Let F be the set of edges of G that fail to decode x on tt, let F' be the set of edges of G' that fail 
to decode x on vr', and let S' be the set of vertices of G' on which vr' is inconsistent with plurality 

assignment vr, so rj *== /£' . An edge e' = {u,v) of G' is in F' if and only if e' corresponds to 
some e S -F or if u is in S' (note that since G' is vertex-decoding, we need not consider the case 
where v is in S'). Now, every edge in F has do ■ c corresponding G-edges in G', and every vertex in 
5' has at most 2 ■ do ■ d outgoing edges. Thus, it holds that 

<dQ-c-\F\+2-do-d-\S'\ 

Observe that since every vertex of G has at least one outgoing edge (since G is vertex-decoding), 
it holds that every vertex in G' has at least 2 • do outgoing edges, and therefore n' > 2 ■ do ■ i' . It 
follows that 

^1 = y (20) 



< 



do-c-\F\ + 2-do-d - \S'\ 



^ do-c-\F\ ^2-do-d-\S'\ 



2-do-c-n 2-do-e' 

< El + d ■ 7] 

Observe that the last inequality implies that if r] is small compared to e'^ then ei must be large, 
and vice versa. We turn to consider each of the cases separately. 



The case vi^here t] is small First, consider the case where r] < p-e[/16-d. In this case, we argue 
that vr' is roughly consistent with vr, and therefore the action of G' on vr' is similar to the action of 
G on vr. In particular, we argue that the fraction of edges of G' that reject vr' must be related to 
the fraction of edges of G that reject vr, which is at least p ■ Si- However, since by Inequality [20] it 
holds that ei is large compared to e'l, it will follow that the fraction of edges of G' that reject vr' is 
roughly p ■ e'l, as required. 

More formally, it holds that the fraction of edges touching S' (both incoming amd outgoing) is 
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at most 



2-do-d-\S'\ _ 2-do-d-r]-e' 

n' 

2 ■ do ■ d • rj 

2 -do 
do ■ d ■ p ■ e'l 
do ■ 16d 

16 

On the other hand, it holds that the size of F (the set of edges of G that reject tt) is at least p-si-n. 
Each such edge has at least do-c corresponding G-edges in G', and since n' < 2-do-{c+l)-n, it follows 

that the fraction of edges of G' that correspond to edges in F is at least (^ 2-do-{c+i)-n ) — P ' ^i/^- 
Furthermore, it holds that 

ei>e[-d-ri>e[-p- e[/l6 > e[/2 

So in fact the fraction of edges in G' that correspond to edges in F is at least p-ei/A > p-£[/8. This 
implies that the fraction of edges of G' that both correspond to edges in F and whose endpoints 
are consistent with vr is at least p ■ e[/8 — p ■ e'i/16 > p ■ e[/16. Since all of these edges reject vr', it 
follows that the fraction of edges of G' that reject vr' is at least p-e'i/16 > p-^-j-e'/lG > j-p-e'/32. 
This implies that the rejection probability of vr' under the decoding distribution of G' is at least 
n (7^ ■ p ■ e'). as required. 



n' 

(Since n' > 2 ■ do ■ £') 
(By assumption on rj) 



The case where rj is large We turn to consider the case where r] > p ■ £\/16 ■ d. In this case, the 
assignment tt' is quite inconsistent with vr, and we argue that a significant fraction of the consistency 
edges reject vr'. More formally, using similar considerations as in the proof of Proposition 16 . 24| every 
set Gv contributes at least ho ■ do • \S' Ci Gv\ rejecting consistency edges. Thus, there are at least 
ho ■ do ■ \S'\ rejecting edges. This implies that the fraction of rejecting edges is at least 

ho - do - \S'\ ^ ho - do - \S'\ 



2-do-d-£' 
ho 



2 ■ d 



■ V 



^ ho , 

^ hp 1 , 

- 3^-'-2-^-' 
ho- J J 

- uTd^-P-' 

which implies that the rejection probability under the decoding distribution is at least (7^ • p ■ e'/^^) ■• 
as required. 



The "furthermore" part For the "furthermore" part of the lemma, first observe that it is easy 
to see from the definition of G' that if G is d-regular then G' is {2 ■ do ■ (i)-regular. For the rejection 
ratio part, note that in the foregoing analysis we lose a l/d factor in two places: 
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1. We lose a factor of l/ti in the proof of Inequality 1201 where our upper bound on the number of 
edges that go out of S is 2- do ■ d-\S\ while our lower bound on n' is only 2-do- i' . However, if 
G is d-regular, then G' is {2 ■ do ■ (i)-regular, and thus the lower bound on n' can be improved 
to 2 ■ do ■ d ■ £' . This implies that Inequality [20] becomes e'l < ei + rj. 

As a result, the case of "small t]" can be extended to all the cases where rj < p - e'i/16, and in 
the case of "large rj" we can assume that r] > p ■ This saves a factor of 1/d in the case 

of "large rj" . 

2. We lose a factor of 1/d in the case of "large rj" , since the lower bound on the number of 
rejecting consistency edges for a set Cy is only ho ■ do ■ \S Ci G.u\, while the upper bound on 
the number of consistency edges in the graph is do ■ d ■ n. However, if G is d-regular then the 
foregoing lower bound can be improved to ho ■ do • d ■ \S Ci C^l, regaining the factor of 1/d. 
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